A vulnerability referred to as "POODLE" (Padding Oracle On Downgraded Legacy Encryption) was recently announced by CERT. The POO8DLE vulnerability is a man-in-the-middle-attack, which means that a 3rd party with access to network traffic could make use of this exploit to decrypt traffic between a client and server. This vulnerability only impacts traffic that is being encrypted by SSL v3, which is a legacy protocol that has been included in modern web browsers for backwards compatibility. By default, moderns browser prefer to make use of TLS (Transport Layer Security) for encrypting connections instead of SSL v3, but because SSL v3 is listed as an available protocol by default, there remains a risk that a browser could decide to downgrade to SSL v3 and thereby expose the connection to this vulnerability.

The only way to mitigate this vulnerability is to prevent the use of SSL v3. This can be done by disabling it on the web server, or by disabling it within the web browser itself. To ensure that this vulnerability isn't an issue for InfraWare users, our engineers will disable SSL v3 on our web servers starting on 11/8/2014 11:59 EST. Browsers (Internet Explorer 7+, Chrome, Firefox) utilizing their default encryption settings should see no impact when this change is implemented, as connections will automatically utilize the preferred TLS protocol. Internet Explorer 6 did not have TLS enabled by default, so Internet Explorer 6 users will need to ensure that TLS is enabled under Tools -> Internet Options -> Security.

Ahead of the November 8th change, InfraWare engineers have already disabled SSL v3 for the IMC Beta and EHR Web Portal Beta. Users are encouraged to open either page and verify that the login page is displayed without issue. If so, your browser is not depending on SSL v3. If you have trouble, that is an indication that you would have trouble on the production sites after the 11/8 change.

Please open a ticket with Support if you should have any questions or concerns regarding the vulnerability or planned changes.

Friday, October 17, 2014

ITC v6.1.12.5.Released

We are excited to announce that ITC Gen 6 (v6.1.12.5) was released today (10/17/2014). The ITC update is available for anyone who would like to manually update their ITC, and will be distributed via auto-update in the near future. After updating to this version, Windows may prompt you to accept the new installation (screenshot below) the next time that the ITC is launched. After clicking 'Install' on this prompt, the ITC will launch as normal.

Please open a ticket with Support if you have any questions regarding these changes.

Release 6.1.12.5 (October 17, 2014)

Improved Address Book performance.
Added option Address Book filter to display Account Level entries only.
Added check box to the bottom of the New Blank Job form to automatically open blank job after it is created.
Improved New Blank Form by allowing multiple characters to by typed in the to various drop lists.
Added ITC User Set ting to expose an Author's external ID in various locations (drop lists, etc).
Added two new search options to Similar Jobs: "Jobs with the same MRN" and "Jobs with the same Acct #".