ArcGIS for Server 10.3.1 Security 2017 Update 3 Patch

• BUG-000098119 - ArcGIS Server exposes internal information.

• BUG-000095713 - Restrict geoprocessing service and extension publishing to administrators only.
• BUG-000095712 - Restrict RMID ActivationSystem to ArcGIS Server processes only.
• BUG-000095244 - Unjoin Join workflow loses line points.
• BUG-000095044 - SQL injection vulnerability that allows unauthorized modification of data.
• BUG-000094671 - EstimateCacheTileSize/ ExportTiles jobs sporadically returns a blank page, which needs to refreshed several times to get jobstatus. Severe error messages are generated when user clicks on refresh.
• BUG-000094082 - Window extents cause join links created by the trace-link tool to create line point links instead of parcel point links.
• BUG-000093884 - SOAP responses from map services do not comply with map server WSDL definition.
• BUG-000093879 - Merge parcels changes original COGO dimensions when flex points are present.
• BUG-000092906 - Map and Image services are vulnerable to a XML external entity injection (XXE).
• BUG-000092447 - Tomcat vulnerability CVE-2014-0099 - Integer overflow attack.
• BUG-000092445- Tomcat vulnerability CVE-2014-0230 - Denial-of-service attack via thread consumption.
• BUG-000091959 - Some COGO properties of arcs are not being updated after using the Remainder tool.
• BUG-000091775 - Forcing closure when creating a New Parcel recomputes the start point of the beginning course.
• BUG-000091182 - Create parallel offset changes bearing values.
• BUG-000090882 - Creating a new parcel on Win 8.1 OS and 10 OS causes ArcMap to crash when using the second join option or forcing closure.
• BUG-000090845 - Restrict access to the Tomcat internal shutdown port.
• BUG-000090534 - Packaging rasters in a catalog with an extent set does not properly clip.
• BUG-000090429 - Reflected XSS vulnerability with generateToken requests occurs sporadically.
• BUG-000090171 - PDF file attachments above a certain size in a feature service fail to display correctly in a browser.
• BUG-000090045 - Optimize field checking on to improve performance of sync import and export.
• BUG-000089636 - Parcel misclose ratio is not getting set properly on a perfect square parcel.
• BUG-000089622 - Parcels that contain line strings with curves move out of place when adjacent parcels are unjoined.
• BUG-000088948 - The Arc Length and Distance values are not updating correctly.
• BUG-000088847 - Tiles from WMTS Services for some coordinate systems (or CSEC2017U3) do not align in ArcGIS Desktop and when served from ArcGIS Server.
  
  Important Note: After applying this patch WMTS services published in EPSG:4326 will not align correctly when consumed in ArcGIS Desktop and ArcGIS Engine. To resolve this issue apply appropriate patch (for ArcGIS Desktop and ArcGIS Engine) from the ArcGIS for (Desktop, Engine, Server) WMTS Tiles Misalignment Patch. 
  
  
• BUG-000088825 - Parcel remainder tool creates gaps and over laps between parcels.
• BUG-000088454 - If a folder path contains letter 'u' after '\' ArcGIS for Server search service fails to register the folder with an error For Input String: "sage".
• BUG-000088191 - The Parcel Fabric Name Parcel tool create gaps on parcels that have a flexed line point.
• BUG-000088180- Line points are maintaining the original To, From and LinePoint ID values when using the Append GP tool.
• BUG-000088145 - Survey dates on control points are being changed to null when creating a connection line in Parcel fabric.
• BUG-000087817 - Bypass relationship processing if it is all records and optimize row copy on create replica.
• BUG-000087751 - An 'out of memory' error occurs while running the Append Parcel Fabric geoprocessing tool on large parcel fabrics.
• BUG-000087677 - Doing specific parcel fabric workflows through the Parcel explorer window causes control points to move to a different xy location when joined.
• BUG-000087361- Using the Parcel Fabric Add Line Point tool deletes existing line points in the same area.
• BUG-000086992 - The parcel fabric least squares adjustment report gives incorrect values for range and standard deviation.
• BUG-000086939 - Line points should not be created on curves when using Parallel Offset.
• BUG-000086412 - Queries against feature services layers that contain a many columns takes longer than queries against the same layers map service endpoint.
• BUG-000086010 - Constructing a parcel on a parent that contains coincident line strings and has been adjusted creates gaps when built.
• BUG-000085852 - Center points that have been merged are not honored once a parcel is opened and edits are kept.
• BUG-000085354 - LinePoints not behaving correctly when working with different joining methods within a parcel fabric.
• BUG-000082640 - When choosing a different location for installation of ArcGIS for Server 10.3 other than the default for the arcgisserver folder, the installation still creates the folder under c:\arcgisserver folder and a new location specified. Also, when the arcgisserver that was initially created is removed, the system automatically creates a new arcgisserver folder with a directories subfolder that is empty.

ArcGIS Server 10.3.1 must be installed before installing this patch.

1. Download the appropriate file to a location other than your ArcGIS installation location.
   
   

   ArcGIS 10.3.1		Checksum (Md5)
   ArcGIS Server	ArcGIS-1031-S-SEC2017U3-Patch.msp	451F8C3AE5E830BDB414357F7F904525

   
   
2. Make sure you have write access to your ArcGIS installation location.
3. Double-click ArcGIS-1031-S-SEC2017U3-Patch.msp to start the setup process.
   
   NOTE: If double clicking on the MSP file does not start the setup installation, you can start the setup installation manually by using the following command:
   
   
   msiexec.exe /p [location of Patch]\ArcGIS-1031-S-SEC2017U3-Patch.msp

Complete the following install steps as the ArcGIS Install owner. The Install owner is the owner of the arcgis folder.

ArcGIS Server 10.3.1 must be installed before installing this patch.

1. Download the appropriate file to a location other than your ArcGIS installation location.
   
   
   

   ArcGIS 10.3.1		Checksum (Md5)
   ArcGIS for Server	ArcGIS-1031-S-SEC2017U3-Patch-linux.tar	98555B024ED08B16FAD5E4F73F9617A5

   
   
2. Make sure you have write access to your ArcGIS installation location, and that no one is using ArcGIS.
3. Extract the specified tar file by typing:
   
   
   % tar -xvf ArcGIS-1031-S-SEC2017U3-Patch-lx.tar
   
   
4. Start the installation by typing:
   
   
   % ./applypatch
   
   
   This will start the dialog for the menu-driven installation procedure. Default selections are noted in parentheses ( ). To quit the installation procedure, type 'q' at any time.

Check the Patches and Service Packs page periodically for the availability of additional patches. New information about this patch will be posted here.

To determine which ArcGIS products are installed, choose the appropriate version of the PatchFinder utility for your environment and run it from your local machine. PatchFinder will list all products, hot fixes, and patches installed on your local machine.

Domestic sites, please contact Esri Technical Support at 1-888-377-4575, if you have any difficulty installing this patch. International sites, please contact your local Esri software distributor.