Dan Scott

Yesterday we (the Evergreen development team) finished wrapping up the Evergreen 2.0 alpha 3 release and made it available for your consumption, inspection, testing, development – what have you.

The released ??files, including the source tarball, staff clients for Windows and Linux, and a virtual image built on Debian Squeeze, are available from the Evergreen downloads page, along with installation instructions.

This alpha release reflects a ton of bug fixes, usability enhancements, and performance imporovements since the alpha 2 release, undoubtedly aided by the concentration of a significant portion of the development teams’ focus on a migration of a large production environment to this code base.

Thanks for contributions to this release are owed to many in the community, but let’s call out special praise for Thomas Berezansky from MVLC for providing us with the Linux staff client packaging target, and to Chris Sharp of Georgia PINES, Anoop Atre of Minnesota PALS, and Benjamin Shum of Bibliomation Inc. for going through the install process in prior alpha releases and providing us with the feedback we needed to correct problems in install process and accompanying documentation.

On Thursday, June 17th, we realized that the open-ils.pcrud service, which provides permission-protected access to Evergreen data in the 1.6 release series, was subject to a security vulnerability. The vulnerability allows a user to access objects outside of the permissions they have been granted by supplying fleshing arguments to the open-ils.pcrud search service.

By Thursday evening, a patch for the vulnerability had been committed to Evergreen trunk, and by Friday evening that patch had been backported to the 1.6.0 branch. The Evergreen 1.6.0.6 security release was uploaded on Tuesday June 22, and it took until late Friday June 26 to write up the upgrade instructions, release notes, and update the downloads page for the http://evergreen-ils.org Web site.

Today, we worked out how to apply just the security fix to a running system, so that Evergreen libraries can close the vulnerability without having to apply the full release upgrade. The procedure is as follows:

1. Download the fixed file: http://svn.open-ils.org/trac/ILS/export/16749/branches/rel_1_6_0/Open-ILS/src/c-apps/oils_cstore.c
2. Copy oils_cstore.c over Open-ILS/src/c-apps/oils_cstore.c in the source directory you used to install your Evergreen system
3. Run ‘make’ to compile the updated libraries
4. Install the chrpath tool (“aptitude install chrpath”)
5. Run “chrpath -d Open-ILS/src/c-apps/.libs/oils_pcrud.so” to enable the library to link to the appropriate location
6. Copy Open-ILS/src/c-apps/.libs/oils_pcrud.so.* to /openils/lib/.
7. Restart the Evergreen C services by running ‘osrf_ctl.sh -a restart_c’

If you are running Evergreen 1.6, we recommend that you apply this security fix as soon as possible, then upgrade to the latest release (1.6.0.6) when you have an opportunity. Evergreen sites running releases prior to 1.6 are not affected by this vulnerability.