McAfee Gateway Appliance Patch 7.5.3

Transcription

1 Release Notes McAfee Gateway Appliance Patch Contents About this release Resolved issues Installation - incremental package Installation - full images Known issues Find product documentation About this release This document contains important information about the current release. We strongly recommend that you read the entire document. Release build - MEG (built: ) Purpose This release adds new features and fixes problems that were reported in previous releases. Rating Vulnerabilities (total: 9, new: 3) Low severity issues (total: 84, new: 73) Recommended McAfee recommends this release for all environments. This update should be applied at the earliest convenience. For more information about ratings, refer to McAfee KnowledgeBase article KB Packaging This release is available in the form of: an incremental update package a set of installable images Resolved issues

2 Vulnerability Update the Oracle Outside In library used on the appliance to address vulnerability CVE (Low severity. Reference: KB81219, KB81220.) Updates the BIND package used on the appliance to address vulnerability CVE (Low severity. Reference: KB81380.) Updates the gnutls package to address vulnerability CVE (Low severity. Reference: KB81685.) Resolves various vulnerabilities in the user interface. (Low severity. Reference: KB Supersedes: 7.5h ) Updates the OpenSSL package to address vulnerabilities CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE (Low severity. Reference: KB81651, KB Supersedes: 7.5h960401, 7.5h965187, 7.5h ) Updates the user interface configuration loading and saving mechanism to address vulnerabilities CVE and CVE by which an authenticated administrator could perform arbitrary actions using crafted HTTP requests. (Low severity. Reference: KB Supersedes: 7.5h938406, 7.5h948770, 7.5h952384, 7.5h960401, 7.5h965187, 7.5h ) Updates the reporting system to correctly escape filter fields from the user interface. This addresses a vulnerability, CVE , to SQL injection by an authenticated reporting user via crafted HTTP requests. (Low severity. Reference: KB Supersedes: 7.5h938406, 7.5h948770, 7.5h952384, 7.5h960401, 7.5h965187, 7.5h ) Updates the Secure Web Mail interface to address user data disclosure and HTTP header injection vulnerabilities. (Low severity. Reference: KB Supersedes: 7.5h938406, 7.5h948770, 7.5h952384, 7.5h960401, 7.5h965187, 7.5h ) Updates the NTP configuration to prevent the appliance being exploited in distributed denial of service attacks using vulnerability CVE (Low severity. Reference: KB Supersedes: 7.5h938406, 7.5h948770, 7.5h952384, 7.5h960401, 7.5h965187, 7.5h ) Operating system Corrects a fault in anti-virus DAT file synchronisation on cluster appliances which sometimes left temporary files in place, progressively filling the disk. (Low severity. Reference: KB81290.) Corrects the synchronization process to ensure certificates removed on the master device are correctly removed on failover and scanning devices. (Low severity. Reference: KB79030.) Updates the Minimum Escalation Report (MER) generation to prevent the temporary session directory created for the MER being deleted, which could cause errors when a MER was being produced from the console command line with a web user interface session active at the same time. (Low severity. Reference: KB79743.) Updates the igb network driver to correct a fault causing it to lock up with a watchdog error. (Low severity. Reference: KB81048.) Adjusts default configuration to improve performance stability on Dell

3 PowerEdge 2950 platforms. (Low severity. Reference: KB81339.) Amends NTP system test so that it does not show misleading error messages when all NTP servers are local. (Low severity. Reference: KB80067.) Addresses a problem with the Intelligent Platform Management Interface (IPMI) on Dell PE1950 hardware which caused intermittent symptoms including slow bootup, failure to display the hardware status, and failure in remote access card configuration. (Low severity. Reference: PD Supersedes: 7.5h965187, 7.5h ) Amends the interface with McAfee Quarantine Manager (MQM) so that quarantined attachments are named correctly. (Low severity. Reference: KB78689.) Correct a fault which, when logical virtual hosting was enabled and configuration was pushed from another appliance, caused the domain given in the SMTP EHLO command to be that of the other appliance rather than the correct virtual domain. (Low severity. Reference: KB79456.) Corrects the handling of delivery in cases where the policy specifies encrypted delivery with Transport Layer Security (TLS) prioritized over Secure Web Mail (SWM) and there are multiple recipient domains of which some support TLS and some do not. (Low severity. Reference: KB81420.) Corrects the Secure Socket Layer (SSL) negotiation code to prevent proxies failing with segmentation violations on some SSL negotiation errors. (Low severity. Reference: KB79976.) Corrects the signal sent to SMTP processes for gathering debug information during Minimum Escalation Report (MER) generation with the option 'Run network tests' enabled. The signal previously sent would terminate the processes, which would then be restarted by the health monitor. (Low severity. Reference: KB81562.) Corrects the "From" address on notification s generated by an encryptiononly appliance, so that originally received with a BATV (Bounce Address Tag Validation) tagged address will show the original address rather than the BATV tagged one, which would not be recognizable to the recipient. (Low severity. Reference: KB79945.) Corrects a problem when domain relay configuration is pushed to the appliance from a McAfee epo server. It was possible for the DNS server on the appliance to not load the zone files corresponding to the domain relays which caused the s to these domains to be queued with a 442 'Unable to determine IP address for delivery' error. (Low severity. Reference: KB78084.) Corrects the message-id on sent via the Secure Web Mail client to conform to RFC2822. (Low severity. Reference: KB81152.) Corrects the handling of Secure Web Mail (SWM) templates so that unsupported '$' escape tokens do not cause delivery failure. (Low severity. Reference: KB79206.) Amends the Secure Web Mail purge to correct an encoding error in file paths, and prevent its selection when another instance of purge is already running, either of which could cause occasional failures. (Low severity. Reference: KB79891.)

4 Increases the default timeout for uploading to McAfee Quarantine Manager (MQM) to allow for large files. (Low severity. Reference: KB81237.) Corrects a segmentation fault in rmdclean when no database connection is available. (Low severity. Reference: KB81461.) Ensures that ws_retryer process doesn't run when McAfee Quarantine Manager (MQM) is not enabled. (Low severity. Reference: KB81680.) Updates the Secure Web Mail service to prevent the possibility of it going offline entirely when restarted at the same time on both master and failover appliances in a cluster. (Low severity. Reference: KB81577.) Improves the appliance memory management to address various issues caused by running out of memory, including poor performance and resource usage alerts. (Low severity. Reference: KB81543.) Amends the user interface certificate validation so that a valid TLS certificate chain will be verified correctly in cases where the CA certificate in the chain is not among the default CA certificates on the appliance. (Low severity. Reference: KB81860.) Updates the Sender Policy Framework (SPF) library to correctly handle several kinds of erroneous SPF records found in the Domain Name System (DNS). (Low severity. Reference: KB81581, KB81686, KB81774, KB81859.) Disables Transport Layer Security (TLS) certificate caching in the SMTP proxy to prevent certificate errors causing connection failures. (Low severity. Reference: KB Supersedes: 7.5h948770, 7.5h952384, 7.5h960401, 7.5h965187, 7.5h ) Content scanning The appliance offers content scanning into the text of certain file types by means of a third party plugin. Update this plugin to address false detections when particular s were scanned. (Low severity. Reference: KB81155.) Amends the credit card numbers dictionary to prevent false detections on s with certain spreadsheet attachments. (Low severity. Reference: KB81612.) Updates the anti-spam engine replication to failover and scanning appliances to show the correct status on the user interface, which was always shown as failed. (Low severity. Reference: KB81561.) Removes the constraint on character set mapping so it will work with disclaimer text addition and encoding other than 8bit. This resolves issues with garbled multi-byte characters resulting from clients specifying an incorrect character set encoding, which can now be addressed by character set mapping. (Low severity. Reference: KB81791.) The appliance offers content scanning into the text of certain file types by means of a third party plugin. Update this plugin to resolve issues which caused the SMTP proxy to fail with a segmentation violation when particular attachment files were scanned. (Low severity. Reference: KB81508, KB81676, KB81679, KB81683.) The appliance offers content scanning into the text of certain file types by means of a third party plugin. Update this plugin to resolve issues which caused the SMTP proxy to consume system resources to excess when particular

5 attachment files were scanned. (Low severity. Reference: KB81157, KB81431, KB81666.) Quarantine Replaces the quarantine digest manager module to address excessive time and resource consumption with large user black and white lists. (Low severity. Reference: KB81681.) Ensures that only one instance of quarantine digest manager runs at any given point in time. (Low severity. Reference: KB81682.) User interface The appliance administrator can create additional user interface accounts with custom roles. Amend the replication process so that such added users can login on the failover device of a blade or cluster system. (Low severity. Reference: KB77886.) Correctly identifies the user who has made a change when prompting others logged on to the user interface to reload configuration. (Low severity. Reference: KB78913.) Amends the spam update network to work with a FTP proxy server which does not proxy FTP over HTTP. (Low severity. Reference: KB79166.) Updates the automatic configuration backup to correctly escape special characters in the FTP password, to prevent failures with some passwords. (Low severity. Reference: KB79454.) Corrects the user interface so that creating a user role with no access privileges does not deny all users access to the Quarantine Configuration pages. (Low severity. Reference: KB79838.) When an IP address is assigned to a cluster appliances, if the number of addresses in the subnet is small, the user interface displays a warning that this will limit the number of scanning devices which can be used. This warning will not now be shown for normal appliances as it is not relevant. (Low severity. Reference: KB81226.) Corrects the httpd configuration to properly block other IP addresses when only specified IP addresses are configured to have access. (Low severity. Reference: KB79990.) Amends the user interface to allow access for users whose role name includes non-ascii characters. (Low severity. Reference: KB80100.) Corrects a fault preventing import of the Commtouch Command Anti Virus engine/database from another McAfee Gateway appliance. (Low severity. Reference: KB81242.) Extends the configuration push feature to provide the ability to push component updates to machines of the same version. (Low severity. Reference: KB79953.) Amends the process for inserting statistics into the database so that multiple instances will not run, which could consume all available database connections and prevent the user interface dashboard loading. (Low severity. Reference: KB81537.) The appliance allows a secondary Commtouch Command anti-virus engine to be used for scanning. The user interface component management page is now amended to show the update status correctly when this engine is not used and updates for it disabled. (Low severity. Reference: KB81288.)

6 Amend the user interface so that generating a Minimum Escalation Report (MER) alone does not enable the "Apply Changes" button. (Low severity. Reference: KB81667.) The user interface gives the ability to view conversation logs for s appearing in message search. This patch corrects a fault which prevented viewing of the logs for some s which had been refused after inspecting the data. (Low severity. Reference: KB81631.) Amends the user interface so as not to enable the "Apply Changes" button when forwarding quarantined s with no configuration change. (Low severity. Reference: KB81516.) Corrects a fault in the configuration push mechanism which prevented Secure Web Mail user and system data from being pushed as it should. (Low severity. Reference: KB81453.) Updates the cron service to address a fault which could cause many instances of the same job to be run on transition to daylight saving time, potentially bringing the system down by exhausting resources. (Low severity. Reference: KB81485.) Makes event (link state change) available for reports. (Low severity. Reference: KB81635.) Amends network driver counter so that proxy mode throughput is measured correctly, rather than being always zero. (Low severity. Reference: KB81523.) Amends the user interface so that when the TLS domains are spread over multiple pages they can still be re-ordered as required. (Low severity. Reference: KB81843.) Corrects the rejected recipient count on the dashboard, which was wrongly including s for recipients not on the permitted recipient list but accepted by LDAP checking. (Low severity. Reference: KB Supersedes: 7.5h965187, 7.5h ) Configuration Corrects the epo merge process which corrupted the user black and while list file causing synchronization of the list from McAfee Quarantine Manager (MQM) to fail. (Low severity. Reference: KB81064.) Amends the SMTP proxy so that it logs an error rather than failing to deliver when configured to send audit copies of s to an address which is not RFC compliant. (Low severity. Reference: KB81678.) Correct an error in the user interface so that users can add /network groups after clicking on the "Add user group" or "Add network group" link when adding policies. (Low severity. Reference: KB81229.) Provides for epo distribution of updates, such as anti-virus and anti-spam data, to managed appliances which do not have sufficient network access to retrieve updates themselves in the usual way. (Low severity. Reference: KB81296.) Updates epo configuration conversion to allow editing in epo of protocol presets which point to a network group. (Low severity. Reference: KB79962.) Resolves problems in hotfix 7.5h with editing TLS lists in the user interface. (Low severity. Reference: KB81406, KB Supersedes: 7.5h952384,

7 7.5h960401, 7.5h965187, 7.5h ) Reporting Updates the events system to prevent the unscheduled sending of aggregated events which was sometimes caused by significant configuration changes. (Low severity. Reference: KB78094.) Corrects the parsing of realtime counters which were being shown as always 0 in scheduled reports. (Low severity. Reference: KB77622.) Corrects the recording of CM scan events in the database so that the reason will appear in reports. (Low severity. Reference: KB77823.) Amends scheduled report generation to show the correct information on quarantine queues when MQM is disabled. (Low severity. Reference: KB78586.) Updates the counting of quarantined items for the dashboard so that the count remains accurate during periods of high traffic. (Low severity. Reference: KB78245.) Updates the SNMP trap to make the object order match that in the MIB. (Low severity. Reference: KB79196.) Amends the health monitor not to generate alerts on restart when a monitored subsystem status changes to available from its initial, unknown, state. (Low severity. Reference: KB81745, KB81822.) Corrects CSV (comma separated values) file export to prevent corruption of multi-line fields. (Low severity. Reference: KB81839.) Updates the SMTP proxy URL reputation detection to prevent cases where the 'Too many URLs found in the message' alert was produced incorrectly. (Low severity. Reference: KB80080.) Amends the aggregated notification generation to show the correct count of SMTP messages received, rather than always zero. (Low severity. Reference: KB81705.) Corrects the Commtouch Command Anti Virus update so that it does not include any proxy server password in log messages. (Low severity. Reference: KB81684.) Amends the Uninterruptible Power Supply (UPS) monitoring system to ensure that alert s are sent properly for UPS events. (Low severity. Reference: KB81249.) Corrects timezone offset handling in reports filtered using Period: Hour to address cases where the Total View tab showed 0 when the Detail and Itemized view tabs showed s had been processed. (Low severity. Reference: KB81611.) Updates the reporting system to allow correct filtering on user names which include non-ascii characters. (Low severity. Reference: KB Supersedes: 7.5h938406, 7.5h948770, 7.5h952384, 7.5h960401, 7.5h965187, 7.5h ) Other issues Corrects an error in Minimum Escalation Report (MER) generation when run from the command line. (Low severity. Reference: KB81558.) Issues resolved in previous releases

8 For information on issues resolved in earlier releases not included above, consult their release notes: Patch (see KnowledgeBase article KB78536) Patch (see KnowledgeBase article KB79289) Installation - incremental package The incremental update package may be installed on a running appliance with the least possible disruption of service. In due course this package, or one superseding it, will be made available for download and install with the appliance auto-update system. For information on using auto-update refer to KnowledgeBase article KB Installation requirements You must have the following McAfee Gateway software installed on the appliance you intend to update with this package: Version 7.5 Patch Patch Superseded releases The incremental package incorporates and supersedes the following earlier releases: Hotfix 7.5h Hotfix 7.5h Hotfix 7.5h Hotfix 7.5h Hotfix 7.5h Hotfix 7.5h Actions on installation At the end of the installation process the following actions will occur automatically: Task The user interface will log off. The appliance will reboot. To install this package: 1. Create a temporary directory on a computer on your network which can access your McAfee Gateway appliance 2. Download the MEG zip file, and save it to the temporary directory. 3. Open your internet browser, and log on to the McAfee Gateway appliance. If installing on a Content Security Blade Server, go first to the Failover Management blade to do the following steps, then repeat them on the

9 Management blade (the content scanning blades will be updated automatically). If installing on an appliance cluster the steps must be done on all the appliances in the cluster, starting with the Failover Management appliance, then the Management appliance, then the remainder. If installing on an appliance managed by epolicy Orchestrator, follow the procedure in KnowledgeBase article KB On the navigation bar, select System Component Management Package Installer. 5. Under Manual Package Install, click Update from file. 6. In the Import package window, click Browse, find the location of the file "MEG zip", click Open, and then click OK. A window displays the package description. 7. Click OK to install the package. Upon completion of the installation the actions noted above will be performed automatically. 8. Clear the browser cache. 9. Log on to the McAfee Gateway appliance, then click About the appliance to check that " " is displayed. Installation - full images Installable images are available for the various types of appliance. For information on installing these images refer to KnowledgeBase article KB When using this method to upgrade an existing appliance, there may be an option to install software while retaining the existing operational data (option "c", "d", or "e" on the install menu). This option is available where one of the following compatible versions is already installed: This release or any superseded releases, but not any later release other than hotfixes Version 7.0 with or later releases Superseded releases The installable images incorporate and supersede the following earlier releases: Version 7.5 Patch Hotfix 7.5h Hotfix 7.5h Hotfix 7.5h Patch Hotfix 7.5h Hotfix 7.5h Hotfix 7.5h Hotfix 7.5h Hotfix 7.5h965187

10 Hotfix 7.5h Known issues For a list of known issues in this release, refer to McAfee KnowledgeBase article KB Find product documentation McAfee provides the imformation you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the McAfee online KnowledgeBase. Task 1. go to the McAfee Technical Support ServicePortal at 2. Under Self Service, access the type of information you need: To Access... Do this... User documentation KnowledgeBase 1. Click Product Documentation 2. Select a product, then select a version 3. Select a product document Click Search the KnowledgeBase for answers to your product questions. Click Browse the KnowledgeBase for articles listed by procuct and version. Copyright 2014 McAfee, Inc. Do not copy without permission. McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others.