Network Security Platform 8.1

Transcription

1 Manager-XC-Cluster Release Notes Network Security Platform 8.1 Revision A Contents About this release New features Enhancements Resolved issues Installation instructions Known issues Product documentation About this release This document contains important information about the current release. We strongly recommend that you read the entire document. This maintenance release of Network Security Platform is to provide few fixes on the Manager and NS9300 XC or M-8000XC Sensor software. Release parameters Version Network Security Manager software version Signature Set NS9300XC Sensor software version M-8000XC Sensor software version XC-640 Load Balancer XC-240 Load Balancer

2 This version of 8.1 Manager software can be used to configure and manage the following hardware: Hardware Version NS9x00-series Sensors (NS9100, NS9200, NS9300) 7.1, 8.1 NS7x00-series Sensors (NS7100, NS7200, NS7300) 8.1 NS5x00-series Sensors (NS5100, NS5200) 8.1 NS3x00-series Sensors (NS3100, NS3200) 8.1 Virtual IPS Sensors (IPS-VM100 and IPS-VM600) 8.1 Virtual Security System Sensors (IPS-VM100-VSS) 8.1 M series Sensors (M-1250, M-1450, M-2850, M-2950, M-3050, M-4050, M-6050, M-8000) 7.1, 8.1 Mxx30-series Senors (M-3030, M-4030, M-6030, M-8030) 7.1, 8.1 XC Cluster Appliances (XC-240) 7.1, 8.1 XC Cluster Appliances (XC-640) 8.1 NTBA Appliance software (T-200, T-500, T-600, T-1200, T-VM, T-100VM, T-200VM) 7.1, 8.1 The above mentioned Network Security Platform software version support integration with the following product versions: Table 1-1 Network Security Platform compatibility matrix Product Version supported McAfee epo 5.0, 5.1, 5.3 McAfee Global Threat Intelligence Compatible with all versions McAfee Advanced Threat Defense , , McAfee Endpoint Intelligence Agent 2.4, 2.5 McAfee Logon Collector 2.2, 3.0 McAfee Threat Intelligence Exchange 1.0.0, 1.0.1, 1.1.1, 1.2 McAfee Vulnerability Manager 7.5 McAfee Host Intrusion Prevention 7.0, 8.0 Currently port 4167 is used as the UDP source port number for the SNMP command channel communication between Manager and Sensors. This is to prevent opening up all UDP ports for inbound connectivity from SNMP ports on the sensor. Older JRE versions allowed the Manager to bind to the same source port 4167 for both IPv4 and IPv6 communication. But with the latest JRE version 1.7.0_45, it is no longer possible to do so, and the Manager uses port 4166 as the UDP source port to bind for IPv6. 2

3 Manager 8.1 uses JRE version 1.7.0_51. If you have IPv6 Sensors behind a firewall, you need to update your firewall rules accordingly such that port 4166 is open for the SNMP command channel to function between those IPv6 Sensors and the Manager. Network Security Platform version 8.1 replaces 8.0 release. If you are using version 8.0 and require any fixes, note that the fixes will be provided in version 8.1. There will not be any new maintenance releases and hot-fix releases on version 8.0. With release 8.1, Network Security Platform no longer supports the Network Access Control module and N-series Sensors. If you are using Network Access Control with N-series (NAC-only) Sensors, McAfee recommends that you continue to use the version. If you are using the Network Access Control module in M-series Sensors, continue to use the version. That is, you should not upgrade the Manager or the Sensors to 8.1 for such cases. Manager software version 7.5 and above are not supported on McAfee-built Dell based Manager Appliances. New features This release is to provide fixes for some of the previously known issues, and does not include any new features. Enhancements This release of Network Security Platform includes the following enhancements: Integration with McAfee Vulnerability Manager enhancements While integrating the Vulnerability Manager with Network Security Manager, in the Database configuration page of Running MVM Scans and Enhancing Alert Relevance, the Password field is cleared after you click Save. This feature has been incorporated as an additional security measure. If you wish to check the server connection for Vulnerability Manager, enter the Password again and then click Test Connection. Manager Infrastructure enhancements In this release, the version of MySQL bundled with the Manager is Resolved issues These issues are resolved in this release of the product. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Resolved Manager software issues The following table lists the medium-severity Manager software issues: ID # The Manager is vulnerable to Tomcat vulnerabilitites prior Automatically generated reports with Japanese characters have unreadable characters in the file name of the report and the title of the report. 3

4 ID # The contact information cannot be saved in the Manager The All Tables backup is not completely exported The snort rule generates alerts for IP addresses that are not specified in the rule With heavy traffic and firewall rules configured, there is high CPU usage in an MDR pair Simulated blocking is disabled unexpectedly When performing Archive Now action under Manage Maintenance Alerts Archiving IPS Archive Now, the browser prompts to resubmit the form The Manager displays MySQL version as After disabling the Inherit Settings option in the Protection Profile page, the option remains enabled after a policy push When a non-standard port is configured to parse http protocol in the Non-Standard Ports page, the port setting displays incorrect port values The customized new UDS with an AttackID added overwrites an existing AttackID Due to malware policy name exceeding the 40 character limit, any changes made to the malware policy cannot be saved While updating a firewall policy, the exception error Unable to Update Firewall Policy. Java.lang.NullPointerException is displayed when you select a rule object in the Firewall Policies page The user defined report generated in the Manager with the criteria as does not equal attack blocked displays the report for equals attack blocked The Manager service often causes high CPU usage of 99%. Resolved NS-series Sensor software issues The following table lists the medium-severity Sensor software issues: ID # The Sensor is vulnerable to CVE ssl/s2_srvr.c in OpenSSL versions prior to 1.0.1r and OpenSSL versions prior to 1.0.2f does not prevent use of disabled ciphers, making it simpler for man-in-the-middle attackers to overcome cryptographic protection mechanisms by performing computations on SSLv2 traffic In rare occasions, Sensor raises Pluggable interface absent Port fault to the Manager even when SFP is present The Sensor reports healthy power supply even when the power cable is unplugged [NS9300] Certain packets such as variants of STP/MSTP are dropped when received on ports in slot 5 and When additional packet logging is enabled, the Sensor might stop sending alert logs or packet logs to the Manager The Sensor is vulnerable against OpenSSH vulnerability CVE (increased brute force attacks which causes denial-of-service by bypassing MaxAuthTries) Due to exhaustion of internal resources related to certain system events, the packet capture files cannot be uploaded from the Sensor to the Manager Non McAfee-Certified SFP system event is incorrectly generated for a McAfee-Certified 4-Port SFP+BFO multi-mode 62.5 μm module [NS9300S] The secondary Sensor in the cluster does not shut down with the shutdown CLI command Concurrent use of logstat all command in the CLI and diagnostic trace upload from the Manager leads to denial of access to the Sensor CLI. 4

5 ID # After successful datapath auto-recovery, the Sensor might go into an asynchronous state The Sensor stops sending packet logs to the Manager when Layer 7 data collection is enabled Some OIDs for Layer 7 data capture memory usage are missing The show intfport CLI command displays an incorrect status in the Sensor CLI for the active fail-open kit The Sensor reboots or hangs after running for days from when the Sensor was last power cycled. Any Sensor reboot initiated from the Sensor CLI or the Manager, or due Sensor software upgrade will not restart the uptime The output of show dospreventionprofile command displays the value for short-term traffic rate as zero packets per second even when there is incoming or outgoing traffic on the Sensor In a corner case scenario, the Sensor incorrectly drops packets and reports it as IP sanity error Link failure fault for port pairs of interconnect ports is incorrectly raised when the port is in Not used state in the Physical Ports page in the Manager Records with are inserted at the beginning of a frame when packet logging is enabled for some attacks An internal hardware event log buffer is not cleared in some scenarios Offline signature set update fails in the Sensor. Resolved M-series Sensor software issues The following table lists the medium-severity Sensor software issues: ID # The Sensor is vulnerable to CVE ssl/s2_srvr.c in OpenSSL versions prior to 1.0.1r and OpenSSL versions prior to 1.0.2f does not prevent use of disabled ciphers, making it simpler for man-in-the-middle attackers to overcome cryptographic protection mechanisms by performing computations on SSLv2 traffic The debug messages are showing up as emergency messages in the Sensor log for Snort rule import The Sensor is vulnerable against OpenSSH vulnerability CVE (increased brute force attacks which causes denial-of-service by bypassing MaxAuthTries) Due to exhaustion of internal resources related to certain system events, the packet capture files cannot be uploaded from the Sensor to the Manager The Sensor is vulnerable against tcp-sack option which does not trigger an alert CVE After successful datapath auto recovery, the Sensor goes into an asynchronous state The Sensor stops sending packet logs to the Manager when Layer 7 data collection is enabled. 5

6 ID # The Sensor is vulnerable against CVE ; race condition in the IPC object implementation in the Linux kernel through allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c. Since existing Sensor deployments use a Linux kernel without this fix, the vulnerability theoretically applies with an extremely low exploit likelihood. The vulnerability is not available through a remote, network vector without authentication. In order to exploit the vulnerability locally, an attacker must first surmount to levels of authentication. Then, a specially crafted application specific to this vulnerability must be scheduled. Sensor applications must then be restarted. The application may only be used to exploit the vulnerability at the time of Sensor initialization In a corner case scenario, a crash in the internal process causes the Sensor to switch to into layer 2 mode When syslog forwarder is configured for IPS events, these events will be sent to the syslog server configured for ACL events When configured to block, the Sensor detects the attack only for the first packet when it sees multiple duplicated UDP packet in a quick succession and misses the attack detection for the UDP subsequent packets Offline signature set update fails in the Sensor. The following table lists the low-severity Sensor software issues: ID # In a rare scenario, when a non-encrypted flow is received on port 443, the Sensor may fail to raise an alert for that particular flow. Resolved XC-640 software issues There are no resolved issues for XC-640 applicable to this release. Resolved XC-240 software issues There are no resolved issues for XC-240 applicable to this release. 6

7 Installation instructions Manager server/client system requirements The following table lists the 8.1 Manager server requirements: Operating system Minimum required Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, English operating system, SP1 (64-bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition, Japanese operating system, SP1 (64-bit) (Full Installation) Windows Server 2012 Standard Edition (Server with a GUI) English operating system Windows Server 2012 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) English operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) English operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) Japanese operating system Only x64 architecture is supported. Recommended Same as the minimum required. Memory 8 GB 8 GB or more CPU Server model processor such as Intel Xeon Same Disk space 100 GB 300 GB or more Network 100 Mbps card 1000 Mbps card Monitor 32-bit color, 1440 x 900 display setting 1440 x 900 (or above) The following are the system requirements for hosting Central Manager/Manager server on a VMware platform. 7

8 Table 5-1 Virtual machine requirements Component Minimum Recommended Operating system Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, English operating system, SP1 (64-bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition, Japanese operating system, SP1 (64-bit) (Full Installation) Windows Server 2012 Standard Edition (Server with a GUI) English operating system Windows Server 2012 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) English operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) English operating system Windows Server 2012 R2 Datacenter (Server with a GUI) Japanese operating system Only X64 architecture is supported. Same as minimum required. Memory 8 GB 8 GB or more Virtual CPUs 2 2 or more Disk Space 100 GB 300 GB or more Table 5-2 VMware ESX server requirements Component Minimum Virtualization software ESXi 5.0 ESXi 5.1 ESXi 5.5 Update 3 ESXi 6.0 Update 1 CPU Memory Internal Disks Intel Xeon CPU ES 2.00 GHz; Physical Processors 2; Logical Processors 8; Processor Speed 2.00 GHz Physical Memory: 16 GB 1 TB 8

9 The following table lists the 8.1 Manager client requirements when using Windows 7, Windows 8, or Windows 10: Operating system Minimum Windows 7 English or Japanese Windows 8 English or Japanese Windows 8.1 English or Japanese Windows 10 English or Japanese The display language of the Manager client must be same as that of the Manager server operating system. Recommended RAM 2 GB 4 GB CPU 1.5 GHz processor 1.5 GHz or faster Browser Internet Explorer 9, 10 or 11 Mozilla Firefox Google Chrome in not supported since the NPAPI plug-in is disabled by default and will not be supported by Google going forward. This means that Java applet support is also disabled by default. Internet Explorer 11 Mozilla Firefox or above For the Manager client, in addition to Windows 7 and Windows 8, you can also use the operating systems mentioned for the Manager server. The following table lists the 8.1 Central Manager / Manager client requirements when using Mac: Mac operating system Lion Mountain Lion Browser Safari 6 or 7 For more information, see McAfee Network Security Platform Installation Guide. Upgrade recommendations McAfee regularly releases updated versions of the signature set. Note that automatic signature set upgrade does not happen. You need to manually import the latest signature set and apply it to your Sensors. The following is the upgrade matrix supported for this release: Component Manager/Central Manager software Minimum Software Version , , (only for NS5x00), (only for XC-640 and NS3x00) NS9300XC Sensor software M-8000XC Sensor software , ,

10 Component XC-640 Minimum Software Version There is no updated version of the Load Balancer software at the time of this maintenance release. XC Known issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: Manager software issues: KB81373 XC-Cluster Sensor software issues: KB81377 Product documentation Every McAfee product has a comprehensive set of documentation. Find product documentation 1 Go to the McAfee ServicePortal at and click Knowledge Center. 2 Enter a product name, select a version, then click Search to display a list of documents. 8.1 product documentation list The following software guides are available for Network Security Platform 8.1 release: Quick Tour Installation Guide Upgrade Guide Manager Administration Guide Manager API Reference Guide (selective distribution - to be requested via support) CLI Guide IPS Administration Guide Custom Attacks Definition Guide XC Cluster Administration Guide Integration Guide NTBA Administration Guide Best Practices Guide Troubleshooting Guide 10

11 Copyright 2016 McAfee, Inc. Intel and the Intel logo are trademarks/registered trademarks of Intel Corporation. McAfee and the McAfee logo are trademarks/ registered trademarks of McAfee, Inc. Other names and brands may be claimed as the property of others. 0A-00