Target audience: This notice applies to iManage Work on-premises environments running iManage Work Server version 9.5 R2 through 10.2.0.

On this page:

    Issue description
    Background
    Action
    Disclaimer
    Remember to Follow for updates

Issue description

A security vulnerability was discovered in iManage Work Server during security testing. The impacted versions of iManage Work Server are installed in on-premises environments.

This vulnerability requires the immediate application of a patch update to avoid a potential breach.
Background

iManage performs security testing internally and through third-party resources as part of our standard quality assurance process. This vulnerability was identified during our most recent round of testing, and consistent with iManage Security Policy it prompted immediate actions to identify the root cause and to initiate a remediation plan for all customers.

For our customers' protection, we reserve the right to not disclose or discuss security issues and the details thereof until we confirm the identified security vulnerability has been remediated with the necessary patch update(s) for all impacted customers.
Action

In this section:

    Actions taken by iManage for on-premises customers
    Actions to take in your on-premises environment


Actions taken by iManage for on-premises customers

iManage has taken the following steps to remediate this issue for iManage Work on-premises customers:

    Released a security patch update for the versions of iManage Work Server affected by this issue. See Actions to take in your on-premises environment.
    Released a new build of iManage Work Server 10.2.0 (10.2.0.186) that contains the required security update. The new build is available on the iManage Work Server 10.x release page.
    Removed all affected iManage Work Server installation packages from Help Center.

    NOTE: In addition to the new build of iManage Work Server 10.2.0 (10.2.0.186) that is now available, we are evaluating a re-release of full installation packages for other versions affected by this issue.

    Click Follow at the top of this advisory page to receive email updates about this pending action item and all other news for this critical issue.


Actions to take in your on-premises environment

Please complete all steps listed in the following sections:

    Delete existing copies of affected iManage Work Server installations.
    Download the security patch update.
    Install the security patch update.
    Validate the patch update.



1. Delete existing copies of affected iManage Work Server installations.

    Delete any copies of installation packages you previously downloaded for versions of iManage Work Server impacted by this issue.
    Ensure that you do not use any previously downloaded installation packages in your environment including development, testing, and production environments.



2. Download the security patch update.

Download iManage Work Server 10.2.0.186 to update all on-premises Work Server 10.2.0.x versions.

Download the security patch update that applies to the on-premises 9.5 R2 - 10.1.3 versions of iManage Work Server and complete the steps provided in the Install the security patch update and Validate the security patch update sections below.

iManage Work Server versions


Security patch update
10.2.0 (10.2.0.122 - 10.2.0.175)

Download and install
Work Server 10.2.0.186.

See iManage Work Server 10.x for installation and release notes downloads.
10.1.3

Download
10.1.2 (10.1.2.42 - 10.1.2.45)
10.1.1
10.1
10.0.2
10.0.1
10
9.5 R2



The iManage Work Server Security Update 2019-06-25.zip file download contains two security patch files:

    iManage Work Server Security Update 20190625 Verbose.exe - Patch installation loads in the Windows PowerShell console, requires acknowledgement to begin the installation process, and records status messages in the console window.
    iManage Work Server Security Update 20190625 Silent.exe - Patch installation runs silently and requires no additional interaction to begin the installation process.



3. Install the security patch update.

Follow the steps below to install the security patch update according to your desired installation type:

    Install the security patch update using the Verbose patch
    Install the security patch update using the Silent patch

The installation steps assume you downloaded the iManage Work Server Security Update 2019-06-25.zip file referenced in the Download the security patch update section.



Install the security patch update using the Verbose patch (iManage Work Server Security Update 20190625 Verbose.exe)

To install the security patch update using the iManage Work Server Security Update 20190625 Verbose.exe file, complete the following steps on each iManage Work Server in your environment.

NOTE: The security patch update stops and restarts the iManage Work Server service.

    Extract the contents of the iManage Work Server Security Update 2019-06-25.zip file to your Work Server machine.
    Open the iManage Work Server Security Update 2019-06-25 folder found in the extracted ZIP file contents.
    Double-click the iManage Work Server Security Update 20190625 Verbose.exe file.
    Type y and press Enter in the Windows PowerShell console when prompted to start the patch installation process.
    Follow the status messages recorded in the Windows PowerShell console until the installation process finishes and close the console window.



Install the security patch update using the Silent patch (iManage Work Server Security Update 20190625 Silent.exe)

To install the security patch update using the iManage Work Server Security Update 20190625 Silent.exe file, complete the following steps on each iManage Work Server in your environment.

NOTE: The security patch update stops and restarts the iManage Work Server service.

    Extract the contents of the iManage Work Server Security Update 2019-06-25.zip file to your Work Server machine.
    Open the iManage Work Server Security Update 2019-06-25 folder found in the extracted ZIP file contents.
    Double-click the iManage Work Server Security Update 20190625 Silent.exe file.
    (Optional) Open the System log in Windows Event Viewer and verify that the installation recorded the following Information level status messages:

    Starting iManage Work Server patching. Stopping Work Server service.

    Finished iManage Work Server patching. Started Work Server service.



4. Validate the patch update.

We will release a patch update validation tool in the near future.

Click Follow at the top of this advisory page to receive an email update once the patch validation tool is available in Help Center.


Disclaimer

The information provided is provided "as is" without warranty of any kind. iManage disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall iManage be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if iManage has been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Remember to Follow for updates.

If you haven't already subscribed to receive iManage Support notifications, complete these two quick steps to stay informed regarding iManage Support news, advisories, upcoming events, and training:

    Open the iManage Support Announcements section of Help Center.
    Click Follow > New articles and comments.