Unknown's avatar

About socalgovgis - Michael Carson

Michael Carson, GIS Manager (retired) for the City of Burbank and President of Southern California Government GIS User Group. Currently teaching GIS at College of the Canyons in Santa Clarita.

Security Vulnerability in Geocortex Viewer for HTML5

If you use Geocortex Viewer for HTML5, update your apps!

From Drew Millen, Geocortex Product Manager at Latitude Geographics Group:

Yesterday we were made aware of a potential security issue affecting all versions of Geocortex Viewer for HTML5, thanks to a vigilant customer contacting our Support team.  While we don’t know of any specific attacks that may have exploited this vulnerability amongst our customers, we take potential security issues very seriously. We’re happy to report that we were able to respond quickly, and a patch will be available for download in the Geocortex Support Center in the coming hours. The patch involves replacing a single JavaScript file and does not require a re-install or that you update Geocortex Essentials.   We recommend customers with applications that use Geocortex Viewer for HTML5 (all versions) apply the patch. Note that the upcoming release of Geocortex Viewer for HTML5 2.4 will not expose this vulnerability. Here’s what you need to know:

  • This issue potentially allows a malicious attacker to craft a viewer URL that loads configuration and code from a domain under their control.
  • This issue is a result of the way viewer configurations have historically been loaded. In the past, attempts to load configurations from other domains were prevented by the browser; however, newer browsers have evolved to support a technology called Cross-Origin Resource Sharing (CORS), which now allows cross-domain requests to be made.
  • An attacker can craft a link to a viewer on a trusted domain, such as http: //trusted/viewer/index.html, that loads their malicious configuration file from a machine that they control. If the attacker’s server is configured correctly, they can serve malicious code to users who have been fooled into clicking the link.
  • An example of a malicious link could be: http: //trusted/viewer/index.html?configBase=http://go.geocortex.com/e/61102/2015-03-26/3qh36/47536401resources/config/default/
  • All browsers supporting CORS — including ones in iOS and Android — are susceptible.

Here’s what we recommend you do:

  • Download the applicable patches we are making available in the Geocortex Support Center. Click the “Geocortex Viewer for HTML5” link and look for Security Update 2015-03-26.zip.
  • Read instructions.txt for notes regarding potential changes to viewer launch links in certain advanced scenarios.
  • Follow instructions.txt for instructions on applying the patch.

We apologize for any inconvenience this issue may cause you. Please get in touch with us if you have any questions or if we can help.

GeoTech PCC Guest Lecture Series

GeoTech PCC Guest Lecture Series Spring 2015
Thursday, April 2, 7-9pm
Pasadena City College, Room E220
More details at http://geotechpcc.eventbrite.com

GeoTech PCC is a new program that just started this semester. We’re fortunate to have Jonathan Robinson and Chandler Sterling from the City of Pasadena give our first guest lectures. We want to make sure that those in the surrounding communities know about it!

California Has One Year of Water Left

According to Jay Famiglietti, the senior water scientist at the NASA Jet Propulsion Laboratory/Caltech and a professor of Earth system science at UC Irvine, California has about one year of water supply left in its reservoirs.  Are you ready to ration?  What is your government agency you work for going to do?  Imagine what this will do to California’s economy … and the way we will live here, or leave for greener pastures.  Check out the LA Times Op-Ed piece.

See also USGS California Drought.

Map History Directory

Interested in map history?  Doing a research projected in map history or cartography?  You might want to check out The International Directory of Researchers in Map History.

The purpose of the directory is to promote communication among researchers who study the history of maps and to provide information about the field to the public.  The directory is an open source for contact information, current interests, research projects, and publications related to map history.  Check it out.