Security Content Update Release Notes for CCS Update

Size: px

Start display at page:

Download "Security Content Update Release Notes for CCS Update"

Madeline Miles
6 years ago
Views:

1 Security Content Update Release Notes for CCS Update

2 Security Content Update Release Notes Legal Notice Copyright 2012 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR and subject to restricted rights as defined in FAR Section "Commercial Computer Software - Restricted Rights" and DFARS , "Rights in Commercial Computer Software or Commercial Computer Software Documentation", as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement.

3 Contents Chapter 1 Getting Started... 5 Post-install Configuration... 5 Chapter 2 Enhancements... 7 Enhancements in SCU New checks... 9 New standards... 9 New additions in predefined platforms Chapter 3 Resolved Issues Resolved Issues Chapter 4 Known Issues Known Issues Chapter 5 Files Added or Updated Files added or updated for Windows Files added or updated for UNIX Files added or updated for VMware... 22

4 4 Contents

5 Chapter 1 Getting Started This chapter includes the following topics: Post-install Configuration Post-install Configuration Before you begin using the Security content update you may need to do the following: Updating the VMware ESXi Machine assets for the VMware platform Refer to the section Upgrading VMware data collection for SCU in the Security Content Update Getting Started Guide Upgrade the CCS assets for Apache Tomcat Standard Refer to the section Upgrading the CCS assets for Apache Tomcat Standard in the Security Content Update Getting Started Guide

6 6 Getting Started Post-install Configuration

7 Chapter 2 Enhancements This chapter includes the following topics: Enhancements in SCU New checks New standards New additions in predefined platforms Enhancements in SCU The Security Content Update (SCU) contains the following enhancements: New standards See New standards on page 9. New checks See New checks on page 9. Target types, asset groups, entities, and fields for the predefined platforms. See New additions in predefined platforms on page 10. VMware Platform Update now enhances the CCS Manager with built-in capabilities to collect data from VMware assets. A new perdefined VMware platform is now added to enable collection of data for VMware ESX/ESXi through vcenter. Note: The settings page for VMware Information Server will not be available after upgrading to SCU.

8 8 Enhancements Enhancements in SCU Refer to the Upgrading VMware data collection for SCU section in the Security Content Update Getting Started Guide Windows Platform The following standard is updated for Windows platform: CIS Windows Server 2003 Legacy Security Settings for Domain Member Servers v2.0 Policy The following policy content is added to CCS in Update: MAS IBTRMV3 - Monetary Authority of Singapore Internet Banking and Technology Risk Management Guidelines. FEDRAMP - Federal Risk and Authorization Management Program ESM release information New platform support SQL Server 2012 The Update adds the following new standards: CIS_for_Sybase_v1.1.0 CIS Security Benchmark for AIX v5.3 and 6.1 Check for missing or installed Windows patches on your Windows assets The Create or Edit Query wizard lets you select the Windows - Patch Assessment entity, to create a query to check for missing or installed Windows patches on your Windows assets. While selecting a scope to patch, you can specify additional scope for patch assessment in the Additional Settings box. Along with the version numbers, you can also match the checksum of the files to verify installed or missing patches. You can check for all patches for all products, or specific patches for one or more bulletins. Note: This enhancement is available only after you install the Product Update or later on CCS Web console - Policies CCS 11.0 now allows you to raise an exception for policies that are accepted by enabling a key in web.config file. To enable the Request Exception option for accepted policies do the following: Take a backup of web.config file located at the folder, <InstallDir>\CCS\Reporting and Analytics\WebPortal

9 Enhancements New checks 9 Under <appsettings> in web.config file, add the following key and save the changes. <add key="enablepolicyexceptiononacceptedpolicy" value="true"/> for enabling the Request Exception option on user accepted policies. Note: If you set the value of the key as false or do not specify any value, then the Request Exception option does not get enabled on user accepted policies. New checks SCU adds new checks to the following standards: Windows platform The following check is updated for the standard, US Federal Desktop Core Configuration Standard (FDCC) V1.0.1 for Windows Vista: Is Service Pack 2 or later applied? UNIX Platform The following checks are updated for the standard, Security Essentials for AIX 5.x and 6.1: Is Service Pack or later applied on AIX 6.1 machines? Renamed from 'Latest Maintenance Level Applied?' to 'Is maintenance level applied on AIX 5.1 machines?' SQL Platform The following check is updated for the standard, Security Essentials for Microsoft SQL Server 2008: Is service pack 3 or higher applied on SQL Server 2008 and service pack 1 or higher applied on SQL Server 2008 R2? The following check is updated for the standard, CIS Security Configuration Benchmark for Microsoft SQL Server 2005 v1.1.1: Is service pack 4 or higher applied on SQL Server 2005? New standards SCU adds the following new standards: Security Essentials for Apache Tomcat Server 5.5/6.0

10 10 Enhancements New additions in predefined platforms VMware Hardening Guidelines for vcenter Servers CIS Security Benchmark for VMware ESX 4.1 v1.0.0 This standard is applicable to UNIX ESX machines 4.1. This standard contains 78 checks. Advanced Checks on UNIX platform Note: If you have existing Windows Machine assets, Symantec recommends that you execute the Asset Import Job with the Update rule for assets evaluation. Only then the Windows Machine assets get updated for the field property, VMware vcenter Server Version, for Update. New additions in predefined platforms SCU updates the following predefined platforms: Windows The additions for the Windows predefined platform are as follows: Target types This update adds the following new target type for the platform: Windows computers with Apache Tomcat Server Installed VMware vcenter 4.0, 4.1, and 5.0 Servers

11 Enhancements New additions in predefined platforms 11 Fields This update adds the following new fields in the Machines datasource for the platform: Is Apache Tomcat Server installed This update adds the following optional field to the Windows machines asset: Is Apache Tomcat Server installed This field returns YES if apache tomcat server is installed as a service or running by executing startup.bat file otherwise returns NO This update adds the following new fields in the Machines datasource for the platform: VMware vcenter Server Version This update adds the following optional field to the Windows machines asset: VMware vcenter Server Version This field reports the version of VMware vcenter Server. Asset Groups Data Sources This update adds the following asset groups for the platform: Apache Tomcat Server Windows Machine - Is Apache Tomcat Server installed Equal To (=) True VMware vcenter 4.0 Servers Windows Machine - VMware vcenter Server Version Equal To (=) ' ' VMware vcenter 4.1 Servers Windows Machine - VMware vcenter Server Version Equal To (=) ' VMware vcenter 5.0 Servers Windows Machine - VMware vcenter Server Version Equal To (=) ' ' This update adds the following new datasource for the platform: Apache Tomcat Server VMware vcenter Server Settings UNIX

12 12 Enhancements New additions in predefined platforms The additions for the UNIX predefined platform are as follows: Target types Fields This update adds the following new target type for the platform: Solaris 11 Machines This update adds the following new fields in the UNIX Machines datasource for the platform: SSL Private Key file SSL Certificate file Microsoft SQL Addition for the Microsoft SQL predefined platform is as follows: Target types This update adds the following new target type for the platform: SQL Server 2012 Instances

13 Chapter 3 Resolved Issues This chapter includes the following topics: Resolved Issues Resolved Issues The Update resolves the following issues: Queries The following issues are resolved for this module: Executing data collection queries on the Linux Server assets caused the system to reboot. This issue was observed when the open system call was executed on the file /dev/watchdog Update resolves this issue. Queries executed on the Content field of the Files datasource failed to respond when it was scoped to /dev and /proc directory Update resolves this issue by blocking the content field for the following cases: dev is mounted at default /dev location. proc is mounted at default /proc location. Proc is mounted at custom location other than /proc. This solution works for the proc file systems which are present in /etc/mtab file. If proc file systems are present on the targets that are not present in the /etc/mtab, then data for the content field is fetched for such directories if requested. Checks for Symantec home directory were retrieving incorrect results. Home directory query scoped to a user having / as a home directory was reporting extra records.

14 14 Resolved Issues Resolved Issues Update resolves this issue and no extra records are reported. Standards The following issues are resolved for this module: Checks executed on Crontab were incorrectly fetching results for /dev and /dev/null also Update fixes this issue and now results for /dev and /dev/null are not fetched. Standard "CobiT CIS Benchmark v1.1.2 for Red Hat Enterprise Linux 5.0 and 5.1" Check"Are there no. or group/world-writable directories in roots $PATH? results to unknown Update fixes this issue. Now accurate results are fetched for the "Are there no. or group/world-writable directories in roots $PATH?" check. For all servers which have SEP 12.1 installed, the check "Is Live update/virus definition 5 days or less" within standard "security Essentials for Symantec Endpoint Protection" will get "Not Applicable" result. SCU resolves this issue. The check Is the Syslog daemon accepting messages from other systems on the network? for the standard " CIS Security Benchmark for HP-UX v.1.3.1" displayed incorrect results. The Update resolves the issue and now accurate results are returned. Evaluation results for the check "Do unowned files exist on the system?" displayed an error and failed to return any value Update resolves this issue. The check "Are dot files in user home directories world writable?" returned partially incorrect results. This issue was observed when the check was executed on the home directories. The Update resolves the issue. Now accurate results are fetched for the "Are dot files in user home directories world writable?" check. Running a Collection-Evaluation-Reporting job with the standard, "CIS benchmark v1.1.2 for RedHat Enterprise Linux 5.0 and 5.1" on agent-less RHEL5.x asset resulted in the following error: Error Special Value encountered in FILE.CONTENT field for the section 11.2 checks: No duplicate uids exist in /etc/passwd No duplicate username exist in /etc/passwd Update resolves this issue and accurate results are reported. Queries executed on the standard "CIS Security Benchmark for HP-UX v 1.3.1" displayed incorrect results.

15 Resolved Issues Resolved Issues Update resolves this issue and accurate results are now fetched on the HP-UX target computers.

16 16 Resolved Issues Resolved Issues

17 Chapter 4 Known Issues This chapter includes the following topics: Known Issues Known Issues The following known issues are observed in the Update: After upgrading to Update, the settings page for Information Server registration of VMware is displayed, however the VMware data collection is not done using the Information Server. When you install SCU on a stand-alone CCS Manager, the following message appears in the Warning panel: Delete ESM standard platform container from the Directory Server. You can ignore the warning and click Next to proceed to the Finish panel. After upgrading to Update the following QuickFix updates will not work as expected: QF An Active Directory user who is not a domain administrator but has read access over the RootDSE objects of Active Directory, can now be configured to successfully create the domain cache. QF Data collection is now possible from the target computers in Non-trusted Domains.

18 18 Known Issues Known Issues

19 Chapter 5 Files Added or Updated This chapter includes the following topics: Files added or updated for Windows Files added or updated for UNIX Files added or updated for VMware Files added or updated for Windows The following files are updated for : Note: The version number for all the files is < >

20 20 Files Added or Updated Files added or updated for Windows Windows.Schema.dll Symantec.CSM.Wnt.UIControls.dll VMware.Schema.dll WntScopes.dll Symantec.CSM.CredentialMgmt.PlatformCredentials.dll Symantec.CSM.Content.Localization.Resources.dll Symantec.CSM.WindowsPlatformContent.WindowsFilePermissions.dll Symantec.CSM.VMwarePlatformContent.VMwareESXi4x.dll Unix.Schema.dll Symantec.CSM.UnixPlatformContent.VMEsx3x.dll UnixScopes.dll Symantec.CSM.UnixPlatformContent.RHELv1.0.5.dll VMwareScopes.dll Symantec.CSM.Control.JobError.MessageSource.dll Symantec.CSM.WindowsPlatformContent.WindowsSettings.dll Symantec.CSM.Resources.ESMSUResources.dll Symantec.CSM.UnixPlatformContent.AIXv1.0.1.dll AgentCleanUp.exe CCSDissolvingAgentStub.exe CCSDissolvingAgentStubx64.exe PAUtility.exe PWCleanUp.exe PWHashDump.exe PWHashDumpX64.exe ADObjectResolver.dll ADPermissions.dll AuditSubCategoryDC.dll BVNTError.dll BVNTObjects.dll BVNTPostFilterEnumerators.dll BVNTProcess.dll BVNTQuery.dll

21 Files Added or Updated Files added or updated for UNIX 21 BVNTSysObjs.dll BVVNTScopes.dll CommonExceptions.dll DumpSAM.dll DumpSAMX64.dll Logging.dll NTADProcess.dll NTAnalysis.dll NTBackEndSnapin.dll NTCommonUtils.dll NTFunctions.dll NTLegacy.dll NTScopeRefinery.dll NTTIVExtensions.dll PortObjectDC.dll QESharedObjs.dll RegistrySecurityDC.dll SecurityAdvisor.dll SharePointDC.dll SharePointDCx64.dll SharePointServer2k7.dll SharePointServer2k7x64.dll TextFileContentDC.dll WinFileHandlers.dll XMLFileContentDC.dll Files added or updated for UNIX The following files are updated in SCU : Note: The version number for all the files is < >

22 22 Files Added or Updated Files added or updated for VMware UNIXTIVSnapin.dll BVUnixUsersDataSource.dll BVUnixSystemDataSource.dll BVUnixFilesystemDataSource.dll BVUnixGroupsDataSource.dll BVUnixMachineDatasource.dll BvUnixFilesDataSource.dll BVUnixACLSecurityDatasource.dll BvCUWinRDCCoreLib.dll BvCURDCCoreLib.dll BvUnixServicesDataSource.dll BVUnixProdInfoDataSource.dll BVUnixDataSourceImpl.dll BvUnixPackagesDataSource.dll BVUnixAPARDataSource.dll BVUnixFileSync.dll Files added or updated for VMware The following files are added or updated in SCU : Note: The version number for the files is < > VMwareRDCCoreLib.dll VMwareWinRDCCoreLib.dll VMwareMachineDatasource.dll VMWARETIVSnapin.dll VMwareNetworkDataSource.dll FieldMetaData.mdb Vmware.assettypedefaultvalues.xml VMwarevCenterServer.Common.EntitySchema.xml VMware.schema.dll

Security Content Update Release Notes for CCS Update

Security Content Update Release Notes for CCS 11.0 2013-3 Update Security Content Update 2013-3 Release Notes Legal Notice Copyright 2013 Symantec Corporation. All rights reserved. Symantec, the Symantec