We are using windows search to search for document on a remote share, after applying security update KB4022726 this functionality breaks.
Our implementation is using oledb connector for windows search in C#
Are there any workarounds besides uninstalling KB4022726?
Update: CVE-2017-8543 might be related.
Sample program - that failes efter install of KB4022726
using System;
using System.Data.OleDb;
namespace windowssearchtest
{
class Program
{
static void Main(string[] args)
{
var computer = "searchserver";
var filepath = @"documents";
var query = $@"
Select System.Itemname
FROM {computer}.systemindex
WHERE SCOPE='file:\\{computer}\{filepath}'";
const string ConnectionString = "Provider=Search.CollatorDSO;Extended Properties=\"Application=Windows\"";
OleDbDataReader myDataReader = null;
OleDbConnection myOleDbConnection = new OleDbConnection(ConnectionString);
OleDbCommand myOleDbCommand = new OleDbCommand(query, myOleDbConnection);
myOleDbCommand.CommandTimeout = 180;
try
{
myOleDbConnection.Open();
myDataReader = myOleDbCommand.ExecuteReader();
if (myDataReader != null && myDataReader.HasRows)
{
Console.WriteLine($"HasRows: {myDataReader.HasRows}");
while (myDataReader.Read())
{
}
}
}
catch (Exception e)
{
Console.WriteLine(e.ToString());
}
}
}
}
Error:
System.Data.OleDb.OleDbException (0x80004005): Uspecificeret fejl
ved System.Data.OleDb.OleDbDataReader.ProcessResults(OleDbHResult hr) ved System.Data.OleDb.OleDbDataReader.GetRowHandles() ved System.Data.OleDb.OleDbDataReader.ReadRowset() ved System.Data.OleDb.OleDbDataReader.Read() ved windowssearchtest.Program.Main(String[] args) i C:\projects_local\windowssearchtest\windowssearchtest\Program.cs:linje 48
Update 2017-06-26 I have also reproduced this error on a local machine running win10 - 1703 Windows search still works, but will throw an error when you reach the end of the resultset, or if empty on .ExecuteReader()
We made a hack to work around this, i will not recommend this:
//pseudo code
while (Wrap(myDataReader))
<snip>
function Wrap(myDataReader)
{
try
{
return myDataReader.Read();
}
catch (ex)
{
if(ex.HResult == -2147467259) return false; //0x80004005
throw;
}
}
