About Symantec Encryption Management Server

Transcription

1 Symantec Encryption Management Server Version Maintenance Pack Release Notes Thank you for using this Symantec Corporation product. These Release Notes contain important information regarding this release of Symantec Encryption Management Server. Symantec Corporation strongly recommends you read this entire document. Symantec Corporation welcomes your comments and suggestions. You can use the information in Getting Assistance to contact us. Product: Symantec Encryption Management Server Version: MP3 Warning: Export of this software may be restricted by the U.S. government. Note: To view the most recent version of this document, go to the Products section on the Symantec Corporation website. What's Included in This File About Symantec Encryption Management Server Changes in this release Additional Information Changed Functionality Technical Support Copyright and Trademarks About Symantec Encryption Management Server Symantec Encryption Management Server provides your enterprise with secure messaging by transparently protecting your messages without user interaction. It automatically creates and maintains a Self-Managing Security Architecture (SMSA) by monitoring authenticated users and their traffic. You can also send protected messages to addresses that are not part of the SMSA. The Symantec Encryption Management Server encrypts, decrypts, signs, verifies messages, and provides strong security through policies you control. Symantec Encryption Satellite provides security for messages up to the user's computer, allows external users to become part of the SMSA, and provides end users the option to create and manage their keys on their computers. Symantec Encryption Management Server is a security tool that uses cryptography to protect your data against unauthorized access.

2 Changes in This Release This section lists the changes in this release of Symantec Encryption Management Server. What's Changed in This Maintenance Pack What's Changed in Symantec Encryption Management Server MP3 Security Resolved the CVE vulnerability (CVE ) with the Apache Web server. [ ] Resolved the CVE vulnerability (CVE ) with Symantec Encryption Management Server by no longer loading the mod_status module. [ ] Administrative Interface Resolved an issue with Symantec Encryption Management Server for System>General Settings, under Server Information, so that the Set System Time dialog now initializes the Time Zone to null and no longer provides a default value for Use NTP Server. [ ] Resolved an issue with Symantec Encryption Management Server so that daily s are now sent when the administrator selects the Send Daily Status option. [ ] Resolved an issue with Symantec Encryption Management Server so that following a PUP update, the Log drop-down list on the Reporting>Logs page includes the entry Clustering SSL. [ ] Symantec Encryption Web Protection Resolved an issue with Symantec Encryption Web Protection so that an reply now correctly handles whitespace between the name and address or special characters in the address. [ , ] Fixed an issue with Symantec Encryption Web Protection so that custom templates work consistently. [ ] Symantec Encryption Desktop Resolved an issue so that a corrupt-data message is no longer written to the Symantec Encryption Desktop log file. This message was triggered when drive encryption was paused and the user restarted the computer. Then the user authenticated at the PGP BootGuard login screen using a WDRT, created a new password in Windows, and updated the policy from the PGP Tray icon. [ ] Resolved an issue with Symantec Encryption Desktop so that when PGP Zip is disabled by policy, it is not listed in the Windows New Document context menu. [ ] Resolved an issue with Symantec Drive Encryption for Mac OS X where client computer identification information (for example, hostname) was not being sent consistently to the Symantec Encryption Management Server. [ ] Resolved an issue with Symantec Encryption Desktop where a missing UUID registry entry on a client computer is now properly handled: for computers already encrypted with Symantec Drive Encryption, persistent entries are written to the client and server logs; for unencrypted computers, encryption is prevented. [ ]

3 Resolved an issue with Symantec Encryption Management Server so that the licensee count increases each time a Symantec Encryption Desktop client enrolls. [ ] Resolved an issue with Symantec Encryption Management Server so that when you click Refresh Groups from Symantec File Share Encryption on a managed client, for a protected folder, the client checks with the server and notifies you if a group has changed and instructs you to re-encrypt the folder. [ ] Resolved an issue with Symantec Encryption Desktop so that super silent enrollment with cached credentials now works. [ ] Keys and Certificates Resolved an issue with Symantec Encryption Management Server when performing certificate path validation in the case where multiple X.509 CA certificates with identical names are present. [ ] You can now successfully change the user key mode for an existing key from SKM to GKM for Windows clients. [ ] Resolved an issue with the Symantec Encryption Management Server so that when an additional decryption key (ADK) is used, client enrollment is successful and the ADK is added to the keyring on the clients. [ ] Resolved an issue with Symantec Encryption Management Server where adding an ADK to a Consumer Policy now saves the ADK on the server and downloads it to the user s keyring when a Symantec Encryption Desktop client enrolls. [ ] What's Changed in Symantec Encryption Management Server MP2 Compatibility with Mac OS X This release supports the installation of Symantec Desktop Encryption on systems running Mac OS X Compatibility with Microsoft Outlook 2013 Symantec Encryption Desktop 10.3 MP2 for Windows supports the use of the Symantec Desktop Encryption, Powered by PGP Technology component for Microsoft Outlook 2013 (32-bit) with Windows 8 and Exchange Compatibility with New Linux Packages This release supports the installation of Symantec Drive Encryption for Linux on Ubuntu LTS (32-bit and 64-bit versions) and Red Hat Enterprise Linux/CentOS 5.9, 6.3, and 6.4 (32-bit and 64-bit versions). Security Resolved the CVE vulnerabilities (CVE , CVE ) with Postfix. [ ] Resolved the CVE vulnerability (CVE ). [ ] Resolved a possible cross-site scripting vulnerability due to a misflagged cookie. [ ] Removed a possible cross-site scripting vulnerability in Symantec Web Protection. [ ]

4 Resolved a potential cross-site scripting (XSS) vulnerability with Symantec Encryption Management Server. [ , ] Administrative Interface Information about what version of Windows a client is installed on now appears on the Devices page. [ ] The Web Messenger log has been renamed to the Web Protection log to reflect product rebranding. [ ] Resolved the issue with Symantec Encryption Management Server management console so that when the Delete All Matching option is selected, only machines that qualify are deleted, not all of the machines. [ ] Resolved an issue that prevented successful keyserver searches. [ ] The Symantec Drive Encryption Activity report now shows the correct number of entries for users with more than one device, with no missing or duplicated entries. [ ] Resolved an issue with Symantec Encryption Management Server so that the nightly SCAN operation no longer generates exception stack traces when updating or inserting due to a database foreign key constraint violation. All user data are now replicated to the other cluster members. [ ] Messaging Resolved an issue so that when the Mail Policy is set to bounce an when suitable key is not found, the Notifier displays the " blocked to all recipients" message and the Non Delivery Report (NDR) contains the "Your message did not reach any of the intended recipients" message. [ ] Resolved an issue with Symantec Encryption Management Server where inbound TLS sessions would occasionally fail with a protocol error. This caused incoming mail to be queued on the sending mail server, resulting in a delivery delay. [ ] Upgrade and Migration Resolved an issue that caused errors to appear when upgrading from Symantec Encryption Management Server MP3. [ ] Migration errors no longer occur when upgrading from PGP Universal Server 3.2 MP5. [ ] Duplicate preferences settings are now removed at upgrade. [ ] Migration no longer causes missing preferences. [ ] Symantec Encryption Web Protection Resolved an issue where case sensitivity with respect to the recipient s address caused the recipient to be unable to access Symantec Web Protection messages. [ ] The First, Previous, Next, and Last buttons now work as expected in the Symantec Web Protector mailbox interface. [ ] Symantec Web Protection now correctly requires both the user's address and passphrase to log in. [ ] Resolved an issue with Symantec Encryption Management Server so that complete customization of Symantec Web Protection now allows a customer to change all references to the product name. [ ]

5 Symantec Encryption Desktop You can now use the pgpusermanager.py script to exclude from deletion users who have not checked in to the Symantec Encryption Management Server. [ ] Resolved an issue with Symantec Drive Encryption where user re-enrollment was incorrectly generating a error under some conditions. [ ] Resolved an issue where key searches through USP did not return user keys if the user's group is associated with the Excluded consumer policy, even if the Excluded policy is not the effective policy. Now user keys are only not returned if the consumer policy in effect is the Excluded policy. [ ] Resolved the issue with Symantec Encryption Desktop so that disabling the Microsoft Outlook 2010 Skip Signature Check button no longer produces an error. [ ] Resolved the issue so that 9.x and 10.0.x clients no longer display an error about a missing license when Symantec Encryption Management Server has been updated to version 3.3 MP2. If, after updating, the error is still there, navigate to the license and click the Use Default button. Then stop and restart services. [ ] Keys and Certificates Resolved an issue so that the X.509 certificates generated by Symantec Encryption Managements Server include the Key Agreement value in the Key Usage properties. [ ] Resolved an issue so that VeriSign Root Certificates imported to PGP Universal Server 3.2 can be used to establish TLS negotiations after upgrading. [ ] You can now successfully change user keys from SKM to GKM for Mac OS X clients. [ ] What's Changed in Symantec Encryption Management Server MP1 Messaging Resolved the issue where the Symantec Encryption Management Server used inconsistent domain names in messages to external users. For more information, contact Support and request assistance with the Symantec Knowledgebase article TECH ( [ ] Clustering Resolved an issue where an unreachable DNS caused clusters to fail and be unable to recover. [ ] Resolved an issue where changing a user's primary address caused the user to disappear from the cluster. [ ] Administrative Interface Resolved an issue where Symantec Encryption Management Server used an incorrect domain name for user names with colons. [ ] Symantec Encryption Management Server now correctly reports client IP addresses when using X-Forwarded-For headers with a Cisco ACE appliance. [ ]

6 You can now sort users on the Groups page by Name, Username, User Type and Address. [ ] On the Clustering page, mousing over the icon that shows Web Protection enabled now displays correct text. [ ] PGP Keys Resolved an issue where Symantec Encryption Management Server did not provide a useful error message in the logs when user keys cannot imported because there is no address specified. [ ] X.509 key lookups now function successfully for addresses with fewer than 25 characters. [ ] When Symantec Encryption Management Server cannot find a key on an X.509 keyserver, the failure no longer causes that keyserver to be marked as down. [ ] Symantec Encryption Web Protection Resolved an issue so that the Symantec Web Protection accounts are deleted based on the Inactivity Expiration value specified in Symantec Encryption Management Server. [ ] Resolved an issue so that users can log in to Symantec Web Protection after the Symantec Encryption Management Server is upgraded. [ ] Messages sent via Certified Delivery now contain the Message ID and Date Header. [ ] Manually sent Daily Status s display correctly in Web Protection. [ ] Upgrading Upgrading no longer causes the creation of duplicate Consumer Policy values. [ ] Automatic backups no longer occur while software updates are in progress. [ ] Symantec Drive Encryption Resolved an issue where viewing WDRTs caused crashing due to migration errors. If WDRTs are not viewable after migration, examine the log files for error messages, and contact Symantec Support to resolve the migration errors. [ ] Symantec Encryption Desktop Resolved an issue that caused searches for external users' keys to fail within Symantec Encryption Desktop. [ ] Symantec Encryption Desktop can now be configured to automatically abort the connection instead of alerting the end user when there is a problem with the Symantec Encryption Management Server certificate. To enable this new behavior, contact Symantec Support. [ ] Installing this Maintenance Pack Following are instructions for installing this maintenance pack release.

7 Installing the Symantec Encryption Management Server Maintenance Pack PUP Update To install the Symantec Encryption Management Server maintenance pack update: 1. Log in to your Symantec Encryption Management Server administrative interface. 2. Select System > Updates. 3. Click Upload Update Package. 4. Select the PUP file and click Upload. 5. Click Install. Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s support offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and/or Web-based support that provides rapid response and up-to-the-minute information Upgrade assurance that delivers software upgrades Global support purchased on a regional business hours or 24 hours a day, 7 days a week basis Premium service offerings that include Account Management Services For information about Symantec s support offerings, you can visit our website at the following URL: All support services will be delivered in accordance with your support agreement and the thencurrent enterprise technical support policy. Contacting Technical Support Customers with a current support agreement may access Technical Support information at the following URL: Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product release level Hardware information

8 Available memory, disk space, and NIC information Operating system Version and patch level Network topology Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes Licensing and registration If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: Customer service Customer service information is available at the following URL: Customer Service is available to assist with non-technical questions, such as the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs or manuals Support agreement resources If you want to contact Symantec regarding an existing support agreement, please contact the support agreement administration team for your region as follows: Asia-Pacific and Japan customercare_apac@symantec.com Europe, Middle-East, Africa North America, Latin America semea@symantec.com supportsolutions@symantec.com

9 Copyright and Trademarks Copyright (c) 2013 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, the Checkmark Logo, PGP, Pretty Good Privacy, and the PGP logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.