- LIS-Forum - ncsi.iisc.ernet.in

[URGENT] Major DSpace security vulnerability affecting all XMLUI sites
by vinod mishra 17 Mar '16

17 Mar '16

---------- Forwarded message ---------- From: Paul Go <pgo(a)iit.edu> Date: Mon, Mar 14, 2016 at 7:48 PM Subject: [dspace-community] Fwd: [URGENT] Major DSpace security vulnerability affecting all XMLUI sites To: dspace-community(a)googlegroups.com We just got this emailed directly to us. I've seen no chatter on the DSpace list. Is this real or no? Paul Go Systems Librarian / Library Technology Manager Paul V. Galvin Library Illinois Institute of Technology 35 West 33rd Street Chicago, IL 60616 312.567.7997 pgo(a)iit.edu Driving Innovation through Knowledge and Scholarship ---------- Forwarded message ---------- From: DuraSpace Security <security(a)dspace.org> Date: Mon, Mar 14, 2016 at 8:47 AM Subject: [URGENT] Major DSpace security vulnerability affecting all XMLUI sites To: DuraSpace Security <security(a)dspace.org> Hello, The DSpace Committers team has been notified of a major security vulnerability affecting all sites that use the XMLUI (DSpace versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, 3.x, 4.x and 5.x). JSPUI sites are unaffected by this vulnerability. If exploited, this vulnerability may allow an anonymous user to view any file on your filesystem that is accessible to the Tomcat user account. By default, this may include your dspace.cfg file (and all related DSpace configurations) as well as any operating system files that are readable by the Apache Tomcat user account. The Committers team is working rapidly to patch this vulnerability in the DSpace XMLUI codebase and release security fixes for 3.x, 4.x and 5.x versions. We expect 3.x, 4.x and 5.x security releases (and patches) to be made publicly available on Monday, March 21st. In the meantime, we have quick fixes available at the bottom of this email which will ensure your site is not vulnerable to these attacks. (Please pass them along to the individual who manages your DSpace.) We ask that you please keep this information confidential and avoid posting questions to our public DSpace mailing lists. In order to protect DSpace sites, we will not be disclosing any further details of the vulnerability until the security releases/patches are available. If you have any questions or concerns, we’ve set up a security(a)dspace.org email address which can be used to privately contact the DSpace Committers and DuraSpace staff. The quick fix options can be found below. Please apply one of them to your site immediately. Because of the nature of this vulnerability, we also recommend changing any passwords (or secure information) that appear in your DSpace configuration files (e.g. database connection passwords). Sincerely, Tim Donohue (on behalf of the DSpace Committers) Tech Lead for DSpace Quick Fixes for XMLUI Vulnerability We HIGHLY RECOMMEND applying one of the following “quick fixes” to your production site immediately. These quick fixes are designed to block all known attack paths and may be left in place until you are able to upgrade to one of the forthcoming DSpace security releases. Because of the nature of this vulnerability, we also recommend changing any passwords (or secure information) that appear in your DSpace configuration files (e.g. database connection passwords). We have three quick fixes available, based on your local DSpace setup. You only need to choose ONE. Apache Web Server Quick Fix (for sites that run an Apache Web Server in front of Tomcat) NGINX Web Server Quick Fix (for sites that run an NGINX Web Server in front of Tomcat) DSpace XMLUI Sitemap Quick Fix (for sites that simply run Tomcat or another Java servlet container) If you have any questions or concerns about these quick fixes, please email security(a)dspace.org. These quick fixes are all considered production-ready, and have already been applied to DSpace sites managed by various DSpace Committers. Option #1: Apache Web Server Quick Fix For any sites that use Apache in front of Tomcat, you can block all affected URLs at the Apache level using "mod_rewrite". This does not actually fix the problem in DSpace, but it does block access to the vulnerable URLs (until you are able to upgrade). For example: # Temporary block using Apache + mod_rewrite # This redirects all vulnerable URLs to /error # (which doesn't exist and throws a 404 response) RewriteEngine On RewriteRule ^/+themes/.*:.*$ /error [R=permanent,L] # If your DSpace XMLUI URL starts with "/xmlui", you should use this instead: # RewriteRule ^/+xmlui/+themes/.*:.*$ /xmlui/error [R=permanent,L] After putting these rules in place, you should be able to simply reload Apache to apply these changes to your site (e.g. sudo service apache2 reload). Be sure to apply this fix for both HTTP and HTTPS URLs, if your site responds to both. To verify the quick fix is working, visit a URL like: http://[dspace.url]/themes/Reference/test:url (Be sure to test both HTTP and HTTPS). The URL should be redirected to [dspace.url]/error/ and a Page Cannot be Found response returned. As long as this occurs, the quick fix was successful. Option #2: NGINX Web Server Quick Fix For any sites that use NGINX in front of Tomcat, you can block all affected URLs from NGINX. This does not actually fix the problem in DSpace, but it does block access to the vulnerable URLs (until you are able to upgrade). Add this to your server or location directive: rewrite ^/+themes/.*:.*$ /error permanent; # If your DSpace XMLUI URL starts with “/xmlui”, you should use this instead: # rewrite ^/+xmlui/+themes/.*:.*$ /xmlui/error permanent; Then run nginx configtest followed by reload. To verify the quick fix is working, visit a URL like: http://[dspace.url]/themes/Reference/test:url (Be sure to test both HTTP and HTTPS). The URL should be redirected to [dspace.url]/error/ and a Page Cannot be Found response returned. As long as this occurs, the quick fix was successful. Option #3: XMLUI Root Sitemap Quick Fix If you are NOT using Apache or NGINX, it is also possible to block all affected URLs within the DSpace XMLUI root sitemap itself. Similar to the above fixes, this can be done while the DSpace site is up-and-running. Simply find the root sitemap (usually at [dspace]/webapps/xmlui/sitemap.xmap) and add the following:   <map:match pattern="themes/**:**"> <map:redirect-to uri="{request:contextPath}/error" permanent="yes"/> </map:match>   <map:match pattern="themes/*"> <map:read src="themes/{1}"/> </map:match> The change will take effect immediately. Any of the vulnerable URLs will be redirected to "/error" (which doesn't exist in DSpace, and will cause DSpace to simply return a 404 Page Not Found error). To verify the quick fix is working, visit a URL like: http://[dspace.url]/themes/Reference/test:url (Be sure to test both HTTP and HTTPS). The URL should be redirected to [dspace.url]/error/ and a Page Cannot be Found response returned. As long as this occurs, the quick fix was successful. If you plan to rebuild/redeploy your DSpace in the near future (prior to your next upgrade), you also should ensure this quick fix is copied into your source code at [dspace-src]/dspace-xmlui/src/main/webapp/sitemap.xmap (or [dspace-src]/dspace/modules/xmlui/src/main/webapp/sitemap.xmap if you are using overlays). That way any future rebuilds and redeploys do not accidentally overwrite these changes. -- You received this message because you are subscribed to the Google Groups "DSpace Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to dspace-community+unsubscribe(a)googlegroups.com. To post to this group, send email to dspace-community(a)googlegroups.com. Visit this group at https://groups.google.com/group/dspace-community. For more options, visit https://groups.google.com/d/optout. -- With Regards, Vinod Kumar Mishra, Assistant Librarian, Biju Patnaik Central Library (BPCL), NIT Rourkela, Sundergadh-769008, Odisha, India. Mob:91+9439420860 Website: http://mishravk.com/ -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Please see the IASLIC News Letter
by Ravindra Mendhe 17 Mar '16

17 Mar '16

Dear LIS Professionals Good Morning! Kindly click on the below link and see page no. 3. http://www.iaslic1955.org.in/fckeditor/userfiles/file/iaslic%20newsletter%2… It is very good and informatics News Letter for LIS Professionals. Thanking you, Sincerely, Ravindra Mendhe Jalgaon ( Maharashtra) ISKCOM 2016 - Conference Website http://iskcom.nmims.edu/ website: http://ravindramendhe.weebly.com/ https://sites.google.com/site/ravindramendhe/ http://ravindra4474.wix.com/ravindralibrary http://circular.lislinks.com/ http://www.scoop.it/t/iskcom/ Conference Website http://iskcom.nmims.edu/ -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Fwd: PKP LOCKSS | Public Knowledge Project
by Shamprasad Pujar 17 Mar '16

17 Mar '16

Dear Members, This could be useful for preserving the content of OJS journals hosted by different institutions in India. You may please see the below mail for more details. Regards, Shamprasad Pujar Deputy Librarian IGIDR, Mumbai ======================================== ---------- Forwarded message ---------- From: Hilton Gibson <hilton.gibson(a)gmail.com> Date: Mon, Mar 14, 2016 at 2:51 PM Subject: PKP LOCKSS | Public Knowledge Project PKP has developed a Private LOCKSS Network (PLN) to digitally preserve OJS journals. The LOCKSS program offers decentralized and distributed preservation, seamless perpetual access, and preservation of the authentic original version of the content. The PKP PLN ensures that journals that are not part of the Global LOCKSS Network, which primarily preserves content from larger publishers and vendors, or an existing PLN, which preserve small numbers of OJS journals hosted by member libraries, can be preserved using the LOCKSS program. For additional details about the PKP PLN, see the high level overview (an early discussion document). https://pkp.sfu.ca/pkp-lockss/ -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

LIS Links Digest, March 16, 2016
by Badan Barman 16 Mar '16

16 Mar '16

Respected Mailing List Subscribers, Kindly find herewith the LIS Links Digest for March, 16, 2016. Job Vacancies 1. Vacancy of Jr Professional Assistant and Library Attendant in University of Hyderabad Web: http://lislinks.com/profiles/blogs/jr-professional-assistant-library-attend… 2. Vacancy of Librarian in University of Mysore, Mysore Web: http://lislinks.com/profiles/blogs/appointment-of-librarian-and-director-as… Seminars / Conferences / Workshops 1. One Day National Workshop on Fundamentals of Thesis Writing Web: http://lislinks.com/events/one-day-national-workshop-on-fundamentals-of-the… 2. Two days workshop on Self Empowerment for Research Scholars through Digital Tools Web: http://lislinks.com/events/two-days-workshop-on-self-empowerment-for-resear… Discussions / Forum / News 1. ISI Kolkata North East Program Web: http://lislinks.com/forum/topics/isi-kolkata-north-east-program 2. DSSSB Finally declared Final Result for the Post Code 02/13 Web: http://lislinks.com/forum/topics/dsssb-finally-declared-final-result-for-th… 3. Regarding joining of librarians through DSSSB Web: http://lislinks.com/forum/topics/regarding-joining-of-librarians-through-ds… 4. Injustice Done by DSSSB Against Qualified Candidate- Librarian Web: http://lislinks.com/forum/topics/injustice-done-by-dsssb-against-qualified-… Regards, Badan Barman, Assistant Professor Department of Library and Information Science, Gauhati University Guwahati-781014, Assam, India. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Are you facing any problem after upgrading your DSpace?
by vinod mishra 16 Mar '16

16 Mar '16

Dear All, Please refer the below document if you are upgrading your old DSpace to latest and facing some problem like deletion of items, community etc. and any indexing related issues. http://mishravk.com/dspace/ Thanking You. -- With Regards, Vinod Kumar Mishra, Assistant Librarian, Biju Patnaik Central Library (BPCL), NIT Rourkela, Sundergadh-769008, Odisha, India. Mob:91+9439420860 Website: http://mishravk.com/ -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Prof. Shivalingaiah- The New Vice-Chancellor of KSOU
by vasappa gowda 16 Mar '16

16 Mar '16

With a request to the moderator to publish Dear all,I am very happy to inform that our LIS professional Prof. D Shivalingaiah is appointed as the Vice- Chancellor of Karnataka State Open University, Mysore. I am very proud and happy to say that he is my PhD guide. He is a very hard working, committed academician. He started his career as an Assistant Librarian at Mangalore University. Soon after his PhD from Mangalore University, he joined as a Reader and the as Professor in the Dept, of LIS at Mangalore University, he has also worked as Deputy registrar, special officer and Regustrar(Evaluation at Mangalore University. He has brought lot of administrative changes in the Mangalore University. Recognising the administrative skills, the Govt. of Karnataka has appointed him as the registrar of Tumkur University and he has worked as the registrar for 8 years. The Govt of Karnataka again appointed him as the Vice Chancellor of KSOU, Mysore. It is an additional feather to his cap. The KSOU is facing lot of problems and I am sure because of the administrative experience, Prof. Shivalingaiah will definitely handle the issues and solve them and bring the name and fame to the University. I join hands with my professional friendly and I pray almighty to give him strength to handle the issues successfully. Karnataka State College Librarians Association, Bangalore and Dakshina Kannada and Kodagu Library Association, Mangalore specially congratulates him and wishes him all the best for his new assignment.With regards Dr. VASAPPA GOWDA, MCom, MLISc, PGDCA, PhDSELECTION GRADE LIBRARIAN, BESANT EVENING COLLEGE, MANGALORE-575 003, KARNATAKA STATE,INDIA.Ph (0824) 2491204(O) (0824) 2453109(R)Mob: 09448150365

1 0

OSS - Koha - Invite for Bits and Bytes Lecture Series
by Ishwar Goudar 16 Mar '16

16 Mar '16

Dear Professional Friends, You are cordially invited to attend the following lecture organized by Karnataka State Library Association (KALA), NCSI-Net Foundation and SRELS. Title: Library Automation using OSS - Koha SPEAKER: Mr. Gopalakrishna, Librarian, BMS Institute of Technology & Management, Bangaluru . PLACE: Sarada Ranganathan Endowment for Library Science (SRELS), 702, 'Upstairs', 42nd Cross, III Block, Rajajinagar, Bangalore - 560 010 DATE & TIME: Friday March 18, 2016 at 6.15 p.m. ABSTRACT: Koha, a world's first truly free Open Source Integrated Library Management System. It is fully featured, scalable for all types and sizes of libraries. Widely used world over including more than 1000 Indian Libraries, Koha supports branch libraries, transfer of items from one branch to another, Search or Retrieve via URL (SRU), full MARC21 and UNICODE, Z39.50, RFID, Discovery tools and CMS to some extent. Koha requires a server running Perl 5.10 or later; MySql 5, Zebra 2.0.22 or greater, and a Webserver preferably Apache2 before installation. It is designed to be used with the support of 3rd party paid support company by spending a nominal amount or by libraries with in-house IT support. Installation can be done using any one of the installation methods viz GIT (Version Control) for developers, Package (Standard) and tarball installation methods. Data migration can be done using MARC Edit application which requires data in text or excel format. With MySql update query knowledge one can port current transactions also from legacy software. One can manage Koha at zero maintenance charges on standard installations. Above all Koha has strong community support like Mailing Lists, IRC etc. While recently version Koha 3.22 has has many advanced features, few Indians are also working towards its development especially adding features useful for Indian Libraries. Few commercial supporters, apart from doing installation, data migration are also offering low cost shared cloud hosting of Koha. One can also take help from Librarian like Mr. Gopalakrishna, who is a self made Koha expert and has helped many libraries in installing and configuring OS LMS Koha on operating systems like UBUNTU. I am sure that many Librarians will get inspired to adopt Koha by attending this lecture. We can also have discussion on issues like customisation, data migration, etc. Regards, Dr. I.R.N. Goudar On behalf of Office Bearers of KAKA, NCSI-NET and SRELS "Access E-Resources for Academic and Research Excellence" *- - - - - - - - - - - - - - - - - -* Dr. I.R.N. Goudar - Adjunct Professor, Mangalore University - Visiting Professor Cum Library Adviser Bangalore University Library, BANGALORE - 560056 - Ex. Visiting Professor Cum Library Adviser, UoM, Mysore - Ex. Scientist 'G' and Head, ICAST, NAL, Bangalore - Ex. Dy Librarian, IITM, Chennai - Ex. Scientist (Information), IICT, Hyderabad - Fulbright Scholar, Univ. of Michigan and Columbia Univ, USA (1995-96) - British Council Scholar (1982-83) E-mail: goudarishwar(a)gmail.com Tel: 080-23215510 Mob: 91+9611165781 (If not reachable pl try land line) -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Request
by Prof. N. Laxman Rao. 15 Mar '16

15 Mar '16

Helo friends Prof Amudha want to have the list of LIS schools in India. If any one has, please send the list or url to her address or put in the groupthanks Prof. N.LAXMAN RAO, President, Telangana Library Association Member, Advisory Board, National Library, KolkataUGC-Emeritus Fellow (2009-11) Professor in Library and Information Science, Osmania University, Hyderabad (super-annuated). Formerly Director, UGC-Academic Staff College (2006-8). Formerly President of Indian Association of Teachers in Library and Information Science (IATLIS) and Association of British Scholars (AP Chapter) . On Tuesday, 15 March 2016, 20:09, amudhavalli Alagusundaram <aamudh(a)gmail.com> wrote: Dear prof Rao garu May I know if I can get a list of LIS schools in India? Thanks Amuda

1 0

OA and Chinese Academy of Sciences
by mailman＠ncsi.iisc.ernet.in 15 Mar '16

15 Mar '16

From: "Subbiah Arunachalam" <subbiah.arunachalam(a)gmail.com> Date: Mon, March 14, 2016 10:40 pm All the more than 100 institutes under the Chinese Academy of Sciences have set up institutional repositories and more than 650,000 research papers have been deposited in these IRs as on 14 March 2016. Best. Arun http://orcid.org/0000-0002-4398-4658 http://www.researcherid.com/rid/B-9925-2009

1 0

Bits and Bytes Lecture Series: Library Automation using OSS - Koha
by Shivaram Gowda 15 Mar '16

15 Mar '16

Dear Members, You are cordially invited to attend the following lecture organized by Karnataka State Library Association (KALA), NCSI-Net Foundation and SRELS. Title: Library Automation using OSS - Koha SPEAKER: Mr. Gopalakrishna, Libraian, BMS Institute of Technology & Mgmt., Bangalore . PLACE: Sarada Ranganathan Endowment for Library Science (SRELS), 702, 'Upstairs', 42nd Cross, III Block, Rajajinagar, Bangalore - 560 010 DATE & TIME: Friday March 18, 2016 at 6.15 p.m. Abstract: Koha is one of the truly free open source, web based, Integrated Library Management Softwares, widely used in small and large libraries of all types throughout the world. Supports branch libraries, transfer of items from one branch to another, Search or Retrieve via URL (SRU), full MARC21 and UNICODE, Z39.50, RFID, Discovery tools and CMS to some extent. Koha requires a server running Perl 5.10 or later; MySql 5, Zebra 2.0.22 or greater, and a Webserver preferably Apache2 before installation. It is designed to be used with the support of 3rd party paid support company or by libraries with in-house IT support. Installation can be done using any one of the installation methods viz GIT (Version Control) for developers, Package (Standard) and tarball installation methods. Data migration can be done using Marc Edit application which requires data in text or excel format. With MySql update query knowledge one can port current transactions also from legacy software. One can manage KOHA at zero maintenance charges on standard installations. Above all Koha has strong community support like Mailing Lists, IRC etc. with warm regards Shivaram BS Treasurer, KALA - -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0