Release Notes McAfee Application Control 6.1.2

Transcription

1 Release Notes McAfee Application Control About this release New features Resolved issues Install and upgrade instructions Known issues Product documentation About this release This document contains important information about the current release. We strongly recommend that you read the entire document. This McAfee Application Control release is available only for the Windows platform and includes: Solidcore Extension Solidcore Client This release was developed for use with: McAfee epolicy Orchestrator McAfee epolicy Orchestrator Purpose This release contains a variety of improvements. We have spent a significant amount of time improving the Observe mode and package control features, adding support for Microsoft Windows Server 2012, and fixing and testing issues. For detailed information on enhancements, review New features. For information on the individual issues, review Known issues and Resolved issues. Rating Recommended McAfee recommends this release for all environments. This update should be applied at the earliest convenience. For more information about patch ratings, see McAfee KnowledgeBase article KB New features This release of the product includes these new features. McAfee GTI reputation for Air Gap environments Starting with this release, we have introduced the Offline GTI feature that retrieves the McAfee Global Threat Intelligence (McAfee GTI) ratings in isolated deployments where the McAfee epo server is not connected to the Internet. Using this feature, the Solidcore extension can fetch McAfee GTI ratings, such as trust level and score, from the McAfee GTI file reputation service for isolated McAfee epo deployments. The McAfee GTI ratings make it easier for the McAfee epo administrator to distinguish between good, bad, and unknown binary files present in the inventory and make informed decisions. For detailed information on this feature, see the McAfee Change Control and Application Control Product Guide. Observe mode enhancements Observe mode is a key capability that helps you discover relevant policies for your setup. In this release, we have improved the Observe mode feature to simplify creation of policies and expedite Application Control deployment. Improved scalability In earlier releases, running a few endpoints in Observe mode caused the McAfee epo database to fill quickly. In earlier releases, only a few endpoints could be placed in Observe mode simultaneously. In the 6.1.2

2 release, we have made significant scalability improvements, allowing you to place an increased number of endpoints in Observe mode simultaneously. Added central console The Policy Discovery page serves as a central console to help you manage all observation and approval requests received from endpoints in your enterprise. McAfee epo administrators can use this page to view and manage received requests, identify policy candidates, and define policies relevant for your setup For detailed information on this feature, see the McAfee Change Control and Application Control Product Guide. Windows Server 2012 support Application Control is now available on the Windows Server 2012 platform. However, these features are not available on the Windows Server 2012 platform: Active X, memory protection, script as an updater. Package Control enhancements The release allows improved control on uninstallation of software packages. Package control feature now provides flexibility in controlling uninstallation of non-microsoft installers (MSI) that do not include embedded MSI files. For detailed information on this feature, see the McAfee Application Control Product Guide. Resolved issues These issues are resolved in this release of the product. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Solidcore extension Applicable Solidcore version HotFix details Description SR number and later When you run the Solidcore: Scan a Software Repository server task, this task erroneously creates installer-based rules for noninstaller binary files and later From the Menu Configuration Solidcore Rules page, you can create a rule group named My Rules even though My Rules is a reserved rule group in the product , 6.0.1, 6.1.0, and If many observations are present in the McAfee epo database, loading the Solidcore Events page is slow and timeconsuming. This occurs because all observation data is scanned before loading the Solidcore Events page to display the Show Suggestions link for relevant events Solidcore client Applicable Solidcore version Affected operating system HotFix details Description SR number All (older than RTW) Windows all (6bit Certain applications create managed dynamic-link library files (DLLs) during runtime that are not whitelisted and are erroneously allowed to load on the system

3 All (older than RTW) Windows all (32-bit When the user tries to install an unauthorized (non-whitelisted) driver on an Application Controlprotected system, the driver is not allowed to run but corresponding EXECUTION DENIED events are not generated All (older than RTW) later (32-bit If you enable the McAfee Deep Defender software on a Windows (32-bit) system where Application Control is enabled, the system might stop because of conflicts with the memory-protection features to Windows all (6bit When using Internet Explorer for 6bit platforms, the memory protection feature erroneously prevents the installation of ActiveX controls to Windows all While parsing through the Tracelist registry value at system startup, the system might stop because of an error in the code to Windows all While uninstalling Application Control, the Run registry key is erroneously deleted to Windows all In a rare scenario, installation of an ActiveX control can fail Windows all The system might stop responding during startup because of conflicts between the Application Control driver and other drivers, such as Acronis True Image later (32-bit A Windows 7 (32-bit) system where Application Control is enabled might not start up or might stop responding when other McAfee products, such as McAfee Data Loss Prevention 9.3, VirusScan Enterprise 8.8 patch 4, or Host Intrusion Prevention System (HIPS) patch 4 are installed on the system. This issue occurs because of a deadlock between the applications If you enable Microsoft Forefront

4 later (32-bit software on a system where Application Control is enabled, the system might stop because of a deadlock later (32-bit If you enable Credant Encryption software on a system where Application Control is enabled, the system might stop because of a deadlock Windows all When enabling the Application Control software, if you schedule the SC:Enable client task to stop after a certain duration, the naprdmgr.exe might crash. This issue occurs because of an error in the scormapl.dll file Windows all (6bit In the McAfee rule group, rules with the McAfee4 updater label erroneously include the updaterui.exe file name instead of udaterui.exe. Also, memoryprotection bypass rules are not added for this binary file causing No execute (NX) violations Windows all When Application Control is enabled with Limited Feature Activation option on a system where McAfee VirusScan Enterprise is installed, the system might stop responding. This issue occurs because of a race condition Windows 7 (6bit If Windows Defender or Windows Security Essentials runs a scan with the latest DAT file (updated on 17 Dec 2013) on a system protected with Application Control, the system might stop responding. This occurs because a query to the WUAUSERV registry entry is resulting in a null pointer exception to Windows all If you restart a system enabled with Limited Feature Activation option, the system might stop responding because of a race condition to Windows all If you install the VMware View software on a protected system, provide updater permissions to scripts, and enable the Self

5 Approval feature, opening the command-line interface (CLI) window fails. This issue occurs due to incompatibility with the VMware View software to to to Windows XP (32-bit) If you enable the Self Approval feature when Application Control is enabled with Limited Feature Activation option, the command prompt (cmd.exe) might stop because of a patching failure. Windows all When you enable Application Control software on a system where IBM Lotus Notes is installed, the system might stop responding during the creation of the whitelist. This issue occurs because of a conflict during product enumeration. Windows all When the SC: Enable client task is received at an endpoint, the Self Approval feature is erroneously enabled. Also, after policy enforcement, the Self Approval feature is disabled Windows all When using Application Control (in Update mode) and Change Control, execution of valid JAR files is blocked. This issue occurs because certain script-auth rules are erroneously added for Change Control in the code to Windows all Because multiple files are added to the whitelist using a deferred checksum, numerous entries appear in the McAfee epo database causing performance degradation Install and upgrade instructions Here is information specific to the release. System requirements Supported platforms To review system requirements for this release, see the McAfee KnowledgeBase article KB This release is available on all supported Microsoft Windows platforms except Windows NT and Windows Upgrade support Solidcore extension This release supports upgrade from these Solidcore extension versions: 5.1.0

6 Note We do not support installation of Solidcore extension on McAfee epo 4.5. Install and upgrade of Solidcore extension is supported on McAfee epo versions 4.6 and 5.0. Solidcore client This release supports upgrade from these Solidcore client versions: Note If you are upgrading the Solidcore client from the release, we recommend that you upgrade in Enabled or Update mode. If you choose to upgrade in Observe mode, review the McAfee KnowledgeBase article KB79517 before upgrading. For information about installing or upgrading Application Control, see McAfee Application Control Installation Guide. Known issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: KB Product documentation Every McAfee product has a comprehensive set of documentation. Document Applies to Description Application Control Product Guide McAfee Application Control Product Guide Managed configuration Standalone configuration Provides information you need to configure, use, and maintain the Application Control product. Provides the information you need to use and maintain the Application

7 Control product. Application Control epo Help Application Control Installation Guide Application Control Installation Guide McAfee Application Control Command Line Interface Guide Managed configuration Managed configuration Standalone configuration Standalone configuration Provides context-sensitive help for all Application Control-specific user interface (UI) pages and options in the McAfee epo interface. Provides information you need to install, upgrade, and uninstall the Application Control product. Provides information you need to install, upgrade, and uninstall the Application Control product. Details all Application Control commands that are available when using the command line interface (CLI). Copyright 2013 McAfee, Inc. Do not copy without permission. McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others.