McAfee epolicy Orchestrator Release Notes

Transcription

1 McAfee epolicy Orchestrator Release Notes Contents About this release What's new Resolved issues Known issues Installation information Getting product information by Where to find product documentation About this release This document contains important information about the current release. We recommend that you read the whole document. Release build Purpose This release adds enhancements and fixes problems that were reported in the previous version. Rating Mandatory Mandatory Critical High Priority Recommended Required for all environments. Failure to apply Mandatory updates might result in a security breach. Mandatory patches and hotfixes resolve vulnerabilities that might affect product functionality and compromise security. You must apply these updates to maintain a viable and supported product. 1

2 For more information, see KB Upgrade paths At the time of the current release, you can upgrade these versions to McAfee epolicy Orchestrator (McAfee epo ) 5.9.1: McAfee epo McAfee epo McAfee epo McAfee epo McAfee epo For information about supported upgrade paths for McAfee epo, see KB Updated components The current release upgrades these components. Apache Http Server Apache Tomcat Java Runtime 1.8.0_152 OpenSSL 1.0.2l Supported platforms The current release is compatible with these platforms. Operating System and Agent Handler Support Windows 2008 R2 Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 Database Microsoft SQL Server and SQL Express Edition 2008 SP1 Microsoft SQL Server and SQL Express Edition 2008 R2 Microsoft SQL Server and SQL Express Edition 2012 Microsoft SQL Server and SQL Express Edition 2014 Microsoft SQL Server and SQL Express Edition 2016 Browser Support Internet Explorer 8.0 or later (including full support for compatibility mode) Firefox 24.0 or later Chrome 30.0 or later Safari 7.0 or later Microsoft Edge (Spartan browser) This version of McAfee epo requires enabling TLS 1.1 or 1.2 support on your browser. 2

3 For information about supported platforms, environments, and operating systems for McAfee epo, see KB What's new The current release of the product includes these enhancements and changes. Replaced Oracle Java Runtime Environment with Azul Zulu JRE The current release replaces the Oracle Java Runtime Environment with the Azul Zulu JRE in McAfee epo. Removed SQL Express from McAfee epo installer The McAfee epo installer no longer provides the option to install SQL Express. SQL Express can still be used with McAfee epo, but it must be installed separately. Interface changes to Software Manager This graphic shows the changes to the Software Manager interface. Added License Key, Edit link At the bottom of the Product Categories tree, next to License Key, click Edit to navigate to the Edit License Key page. There you can edit and save your software license key. The actions that previously appeared in the component description are moved to blue bar above the component list table. Interface changes to Product Deployment This graphic shows the changes to the New Deployment interface. 3

4 Choose the type of deployment These configuration settings were removed and the setting is now configured automatically. In Select your software, the + and were replaced with the + Add another package link at the bottom of the section. In Select the systems, Select Individual Systems, and Select by Tag or Group to display options for selecting systems. 4

5 Select Deployment was added and includes: Auto Update Previously part of Choose the type of deployment. Allow end users to postpone this deployment (Windows only) Previously part of Select the systems. Maximum number of postponements allowed Previously part of Select the systems. Option to postpone expires after (seconds) Previously part of Select the systems. Display this text Previously part of Select the systems. Reworded option Select a start time to Start time. Interface changes to Dashboards This graphic shows the changes to the Dashboards interface. A bell icon appears in the title bar, next to Log Off. A red icon indicates that software updates are available to download. By default, the icon is grey. Click the icon and the Software Manager page opens. Hover over the bell icon to show the software update status. Database Flattened the database views The current release has reduced the number of database tables. Resolved issues The current release of the product resolves these issues. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. 5

6 Security fixes This release addresses several cross-site scripting (XSS) vulnerabilities This release updates the RSA SSL-J and Crypto-J libraries This release updates Apache Http Server to This release signs files with an SHA-2 certificate This release updates OpenSSL to 1.0.2k to address several vulnerabilities. See McAfee SB10197, epolicy Orchestrator is vulnerable to Sweet32 vulnerability (CVE ), for details This release adds TLS 1.2 support for McAfee epo outbound connections This release addresses a CVE vulnerability Windows Authentication now correctly functions after disabling SMBv1. Client and server tasks When a client task is created or edited by a user who does not have administrator rights, the Owner group is no longer incorrectly set to Administrators You can now run an external command as a server task action without the next action starting before the command completes Server tasks configured to run client tasks on the results of a query are no longer categorized as failed if the query returns no results When multiple McAfee epo servers are registered with policy sharing enabled, the Synchronize Shared Policies server task now continues to execute if it can't connect to a registered server Client tasks no longer inherit settings from the My Organization level when inheritance was broken at a lower group In some cases, saving a policy causes the McAfee epo console to become unresponsive for 15 or more minutes. This release resolves this issue The randomization setting in the sub-action under the Wakeup Agent, Run Client Task Now, and Client Task Assignment server tasks is now enforced correctly Opening a client task no longer takes an unusually long time If you try to create a client task with a name that is already used, you're notified and the Save button is disabled. Database The McAfee epo console is no longer slow to edit or save certain custom queries due to inadequate indexing on the EPOServerEventsMT table in the database When an Active Directory synchronization task syncs with a large number of systems, the McAfee epo server can reach a MAX connection state, rejecting new agent-server communication requests until the task is complete. This release resolves this issue You can now successfully convert Universal Time Coordinated (UTC) to Eastern Standard Time (EST) If the SQL Server is running long transactions, the SQL TempDB can grow in size, eventually running out of space and causing the data channel tables in the database to grow. This release resolves this issue. 6

7 Policy, tag, and key management When using the Firefox browser, McAfee epo now opens the Edit Assignment page when you save a policy assignment on a single endpoint In the Tag Catalog, tags are now successfully applied after creating a tag Text strings are now correctly displayed in the Policy Comparison page An Active Directory synchronization no longer creates duplicate entries if the system is in the System Tree and Leave systems in their current location is selected Tags set to apply on every agent-server communication based on IP are now properly applied Tags with double-byte characters are now successfully applied to endpoints Policy owner information in Broken Inheritance is now correctly displayed Applying a tag using the Contain pattern comparison no longer generates the error S-Expression in tag ID x did not match. Queries and reports Running a query as a non-administrator no longer generates the error message An error occurred while retrieving the requested data Duplicate query entries now include the correct query name Queries that run in the McAfee epo console no longer hang and always return results The product version is now correctly displayed after the Bar Chart query runs and returns the results On the System Details page, the installed McAfee Agent version now appears, instead of EPOAGENT On the Actions tab of the Server Task Builder, if the query Agent Uninstalls Attempted in the Last 7 Days is preselected, the Sub-Actions option is now enabled When exporting data from some queries and reports to XML, the XML file no longer contains redundant carriage return, line feed (CRLF) The Pie Chart query now correctly runs in a standalone query On the System Details page, DAT-Version (VirusScan Enterprise) is now correctly displayed. System Tree During an Active Directory synchronization, excluded containers are no longer added to the System Tree Duplicate systems no longer frequently appear in the System Tree Selecting System Tree Select a machine Action Show Client Events no longer generates the error The requested resource was not found All systems are now visible when you test sorting in the System Tree with sorting disabled or enabled Custom property fields now remain visible after entering a new value When Active Directory synchronization runs, some systems are no longer populated to unexpected locations in the System Tree. 7

8 System Tree path now provides the correct result of the Applied Client Task query The System Tree now moves systems to the correct folder with sorting disabled. Upgrades and installation Permission sets with Global Reviewer permissions no longer change after upgrading from to The McAfee Agent installation path is now correctly displayed as Program Files\McAfee\Agent if you're logged on in French The McAfee Agent 5.x default installation path is now correctly displayed as Program Files\McAfee \Agent instead of Program Files\McAfee\Common Framework Upgrades no longer fail because a SQL Server user is no longer required to have system administrator rights In some cases, combinations of 1024 certificates and cipher suite lists caused failed connections, resulting in upgrade issues. This release resolves this issue. User interface Translated migration text now consistently appears in the Root Certificate section in the Certificate Manager In the Tag Catalog Preview page, the option Reset X manually tagged and excluded systems is now grayed out if you create a tag with no criteria, manually create a computer object, and assign the tag to the computer The title Create New Task in the pop-up window is now translated and displayed correctly A space is no longer missing between continuous and deployment on the New Deployment page In the System Tree, Threat Events in the Last 2 Weeks now appears in the correct size. Miscellaneous Reviewers are no longer given Global Administrator permissions after upgrading from 4.6.x to 5.1.x, or after exporting permissions from 4.6.x to 5.1.x An Apache out-of-memory condition no longer causes a failure to process data channel requests that resulted in agent-server communication failures with Connection refused and Server busy error messages This release replaces Oracle Java Runtime Environment with Azul Zulu JRE The McAfee epo Application Server (Tomcat) no longer crashes when an Active Directory synchronization task runs and the task is unable to connect to the LDAP server From McAfee Endpoint Security, Automatic Response s containing the {threatactiontaken} variable now return the correct value If you remove a server task, it no longer stays in the Task Queue in the database, resulting in the process trying to validate the deleted server task every minute The Run at every policy enforcement (Windows only) option is no longer available. This feature was deprecated in McAfee Agent

9 The McAfee epo Application Server (Tomcat) no longer crashes when replicating to distributed repositories due to Java heap corruption Checking in an Extra.DAT file no longer generates data truncation errors in the Orion Log Creating an Automatic Response with multiple groups using the Defined at filter, and adding two groups with an Or operator, no longer generates the error message Can't continue editing this response since it has been put into an invalid state. Click OK to return to the responses page Custom properties are now always removed from McAfee epo when they are removed from an endpoint A user with Global Reviewer permissions can now view Client Event details This release resolves an Agent Handler issue where a null pointer error can lead to an Apache out-of-memory condition, resulting in agent-server communication failure until Apache restarts. Known issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: KB Installation information The current release of the product has specific installation requirements and best practices. For information about installing or upgrading epolicy Orchestrator software, see the McAfee epolicy Orchestrator Installation Guide. Best practice: Run the Pre-Installation Auditor Before you upgrade McAfee epo, run the McAfee epo Pre-Installation Auditor to reduce or prevent upgrade issues. Running the auditor automates many of the verification tasks included in the upgrade process. Task 1 Download the McAfee epo Pre-Installation Auditor from the McAfee epo Downloads page: secure.mcafee.com/apps/downloads/my-products/login.aspx 2 Double-click epip.exe to start the auditor, then follow the prompts. For more information, see the McAfee epo Pre-Installation Auditor Release Notes. Upgrade McAfee epo in a Windows cluster If you are upgrading McAfee epo in a Windows cluster, you must delete the certificates from your quorum disk. Deleting the certificates prevents service startup failures in a failover situation (see tracking issue ). Delete these files in <EPO>\Apache2\conf\ssl.crt: 9

10 ahcert.crt ahpriv.key mfscabundler.cer Requirements for installation or upgrade if using SSL connection to SQL Server Your installation or upgrade might fail if you use an SSL connection between your McAfee epo server and your SQL database. This release of McAfee epo updated the RSA libraries that have additional security requirements for communication with the database. To meet the new compatibility requirements, install all available Windows updates on your McAfee epo server and the SQL Server before starting the installation or upgrade. For more information, see KB Enable TLS 1.1 or 1.2 on your browser This version of McAfee epo requires enabling TLS 1.1 or 1.2 support on your browser. To provide additional security for the communications between your web browser and your McAfee epo server, you must enable TLS 1.1 or 1.2 support on your browser. See the documentation for your browser to enable TLS 1.1 or 1.2 support. Getting product information by The Support Notification Service (SNS) delivers valuable product news, alerts, and best practices to help you increase the functionality and protection capabilities of your McAfee products. To receive SNS notices, go to the SNS Subscription Center at to register and select your product information options. Where to find product documentation Go to docs.mcafee.com to find the product documentation for this product. Go to support.mcafee.com to find supporting content on released products, including technical articles. Copyright 2018 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. 0-00