McAfee Advanced Threat Defense 3.4.8

Transcription

1 Hotfix Release Notes McAfee Advanced Threat Defense Revision A Contents About this release New Features Enhancements Resolved issues Installation and upgrade notes Known issues Product documentation About this release This release notes announces the availability of McAfee Advanced Threat Defense software version for McAfee Advanced Threat Defense Appliance models ATD-3000 and ATD If you plan to integrate this version of McAfee Advanced Threat Defense and with other supported products, then the minimum software combination supported is as listed below: We strongly recommend you to upgrade your McAfee Advanced Threat Defense software to or a later version. Product Name McAfee Network Security Platform McAfee Web Gateway McAfee Gateway Version Network Security Manager: or later Signature set: or later M-series: or later NS-series: or later Virtual IPS: or later or later or later 1

2 Product Name McAfee Next Generation Firewall (McAfee NGFW) McAfee Data Exchange Layer McAfee Threat Intelligence Exchange McAfee Agent McAfee VirusScan Enterprise McAfee Enterprise Security Manager (McAfee ESM) Version 5.8 or later or later or later or later 1247 or later or later New Features This release of McAfee Advanced Threat Defense includes the following new features and enhancements. Addition of new syslog event With this release, if a sample cannot be analyzed, a new syslog event is added. Support for new file types This release supported additional file types: PowerShell script(.ps1) HTML applications(.hta) Microsoft Outlook message(.msg) Updated NTP We have updated NTP rpm to ntp-4.2.8p4 that addresses low and medium-severity security issues. Enhancements This release of the product includes these enhancements. Vulnerability fixes This release provides fixes for these vulnerabilities: CVE CVE CVE CVE

3 Resolved issues These issues are resolved in this release of the product. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Resolved McAfee Advanced Threat Defense Appliance software issues The following table lists the resolved high-severity issues: ID # Issue Description CSRF and SQL injection vulnerabilities detected in ATD SQL injection,css, and CSRF vulnerabilities detected in ATD UI The ATD CLI hangs. The following table lists the resolved medium-severity issues: ID # Issue Description If the option, Skip files if previously analyzed is set to on, blacklist doesn't work for samples from Network Security Platform On executing removesampleinwaiting CLI command, the contents of "/vedata/temp/ preserve" directory are not deleted Manual content update for Gateway Anti-Malware does not complete No reason displayed for System Health:Bad Final Severity - Failed for vtest32.exe in win8-64 bit VM Manual Update Package (.upd) is not uploaded to ATD UI ATD is sending all events to syslog server even when only configured to send medium or higher Lots of php files seen in /vedata/temp Sandbox analysis stops during URL submission ATD cluster primary node GUI eventually becomes unresponsive When the device reboots, delete the temp files install.run and install.progress ATD returns a negative value to atdfilewaiting SNMP query PDF samples are not executing in customer specific VM Old syslog format (RFE3164) is used when upgrading from to directly Cmd, bat, and vbs files shows result as file type not supported Complete sample analysis report is not available for blacklisted samples VM profile gets created by self, and indefinitely shows VM creation is in progress For the same MD5 sample, different results are shown for sandbox analysis After integrating with Gateway, lot of unwanted profiles are created in ATD PPTX file analysis fails in the VM Specific JAR file is not analyzed in VM If the Analyzer profile has Skip File Analysis selected and the sample is previously analyzed, ATD doesn't send score with response to NSP [Yara Scanner]No error logged in system log for failed to import yara rules Firefox isn't used for analyzing samples that are manually uploaded even when Firefox is the default browser Invalid URL issue. 3

4 ID # Issue Description Inconsistent sample behavior due to sample crash in the VM class files not analyzed by ATD. Installation and upgrade notes Review the following before you install McAfee Advanced Threat Defense in your network. If you have already deployed McAfee Advanced Threat Defense and you require information on how to upgrade to this release of McAfee Advanced Threat Defense, refer to step 3 below. If you are installing McAfee Advanced Threat Defense, then review the steps below. 1 Review the Warnings and cautions and the Usage restrictions sections in the McAfee Advanced Threat Defense Product Guide. 2 Refer to McAfee Advanced Threat Defense Product Guide for information on how to install the McAfee Advanced Threat Defense Appliance. You can also refer to the McAfee Advanced Threat Defense Quick Start Guide for information on how to quickly set up the McAfee Advanced Threat Defense Appliance. 3 Refer to the Upgrade McAfee Advanced Threat Defense and Android VM section in the McAfee Advanced Threat Defense Product Guide and upgrade the embedded McAfee Advanced Threat Defense software to If the current version is below than and you want to upgrade to 3.4.8, you upgrade the McAfee Advanced Threat Defense to or above and then upgrade to If the current version is or above, you can directly upgrade to Once you upgrade, you cannot downgrade by loading the backup image using the reboot backup command. Once you upgrade to 3.4.8, you cannot downgrade by using system.msu files. Once you upgrade to 3.4.8, use copyto backup command to ensure that the Active disk and Backup disk remain on the same software version of McAfee Advanced Threat Defense. Boot from Backup disk is not supported in case the Backup disk and Active disk reside at different software versions of McAfee Advanced Threat Defense. The Android version in the default Android analyzer VM is 2.3. After you upgrade McAfee Advanced Threat Defense software to 3.4.8, you can upgrade the Android version to 4.3. We strongly recommend you to upgrade your McAfee Advanced Threat Defense Appliance to or later versions. 4 Refer to McAfee Advanced Threat Defense Product Guide and configure it for malware analysis. 5 To integrate with Network Security Platform, refer to the corresponding Network Security Platform release notes as well as the latest Network Security Platform Integration Guide. Recall that you need a Manager and a Sensor on version 8.0 or later. 4

5 6 To integrate with McAfee Web Gateway, you need McAfee Web Gateway or later. Refer to the McAfee Web Gateway Product Guide. 7 To integrate with McAfee epo, you need version 4.6 or later. In order to integrate McAfee Advanced Threat Defense with McAfee Threat Intelligence Exchange (TIE), you need or above version of McAfee epo. The information for this integration is in the McAfee Advanced Threat Defense Product Guide. Known issues McAfee Advanced Threat Defense software issues in this release: KB Product documentation Every McAfee product has a comprehensive set of documentation. Find product documentation 1 Go to the McAfee ServicePortal at and click Knowledge Center. 2 Enter a product name, select a version, then click Search to display a list of documents product documentation list The following software guides are available for Advanced Threat Defense release: Quick Start Guide Product Guide API Reference Guide Copyright 2015 McAfee, Inc. Intel and the Intel logo are trademarks/registered trademarks of Intel Corporation. McAfee and the McAfee logo are trademarks/ registered trademarks of McAfee, Inc. Other names and brands may be claimed as the property of others. 0A-00