<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Dear IPT users,<br><br>This is an important message. <br><br>IPT administrators should update their IPTs to the new version which has a security update and was released yesterday: <a href="https://code.google.com/p/gbif-providertoolkit/">https://code.google.com/p/gbif-providertoolkit/</a><br><br>The security update fixes critical vulnerabilities that have been discovered in the Apache Struts web framework, which the IPT uses. <br><br>According to <a href="http://www.computerworld.com/s/article/9241639/Hackers_target_servers_running_Apache_Struts_apps?source=CTWNLE_nlt_security_2013-08-15">this article</a>, these Struts vulnerabilities allow hackers to break into a server. It goes on to say that hackers are actively exploiting these vulnerabilities.<br><br>Simple instructions on how to update your IPT are below. If you don't have time to update your IPT immediately, I would advise you to take it offline until you can.<br><br>You can refer to <a href="https://www.mandiant.com/blog/responding-attacks-apache-struts2/">this article</a>, which describes how to determine if you have been attacked.<div><br></div><div>Please email the IPT list directly for more help upgrading your installation.<br><br>Sincerely,<br><br>Kyle, on behalf of the IPT development team and the GBIF Secretariat<br><br>Instructions how to update IPT in Tomcat:<br><div><ol><li>Please download: <a href="https://gbif-providertoolkit.googlecode.com/files/ipt-2.0.5-security-update-1.war">https://gbif-providertoolkit.googlecode.com/files/ipt-2.0.5-security-update-1.war</a></li><li>Backup IPT data directory somewhere safe</li><li>Remove ipt.war from $tomcat/webapps/ (some seconds later, the deployed /ipt folder should automatically delete)</li><li>Once ipt.war and /ipt have been removed from /webapps - stop Tomcat</li><li>Add new version to /webapps renaming it from ipt-2.0.5-security-update-1.war to ipt.war</li><li>Start Tomcat</li><li>In a browser open the application (if it doesn't appear at first, try restarting Tomcat once more).</li><li>When prompted for IPT data directory, enter same location as existing IPT data directory </li><li>Press continue, hopefully installation succeeds.</li></ol></div></div><div><br></div></body></html>