Network Security Platform 8.1

Transcription

1 Manager-Virtual IPS Release Notes Network Security Platform 8.1 Revision A Contents About this release New features Enhancements Resolved issues Installation instructions Known issues Product documentation About this release This document contains important information about the current release. We strongly recommend that you read the entire document. This maintenance release of Network Security Platform is to provide few fixes on the Manager and Virtual IPS Sensor software. Release parameters Version Network Security Manager software version Signature Set Virtual IPS Sensor software version This version of 8.1 Manager software can be used to configure and manage the following hardware: Hardware Version NS9x00-series Sensors (NS9100, NS9200, NS9300) 7.1, 8.1 NS7x00-series Sensors (NS7100, NS7200, NS7300) 8.1 NS5x00-series Sensors (NS5100, NS5200) 8.1 1

2 Hardware NS3x00-series Sensors (NS3100, NS3200) 8.1 Virtual IPS Sensors (IPS-VM100 and IPS-VM600) 8.1 Virtual Security System Sensors (IPS-VM100-VSS) 8.1 Version M series Sensors (M-1250, M-1450, M-2850, M-2950, M-3050, M-4050, M-6050, M-8000) 7.1, 8.1 Mxx30-series Senors (M-3030, M-4030, M-6030, M-8030) 7.1, 8.1 XC Cluster Appliances (XC-240) 7.1, 8.1 XC Cluster Appliances (XC-640) 8.1 NTBA Appliance software (T-200, T-500, T-600, T-1200, T-VM, T-100VM, T-200VM) 7.1, 8.1 The above mentioned Network Security Platform software version support integration with the following product versions: Table 1-1 Network Security Platform compatibility matrix Product Version supported McAfee epo 5.0, 5.1, 5.3 McAfee Global Threat Intelligence Compatible with all versions McAfee Advanced Threat Defense , , McAfee Endpoint Intelligence Agent 2.4, 2.5 McAfee Logon Collector 2.2, 3.0 McAfee Threat Intelligence Exchange 1.0.0, 1.0.1, 1.1.1, 1.2 McAfee Vulnerability Manager 7.5 McAfee Host Intrusion Prevention 7.0, 8.0 Currently port 4167 is used as the UDP source port number for the SNMP command channel communication between Manager and Sensors. This is to prevent opening up all UDP ports for inbound connectivity from SNMP ports on the sensor. Older JRE versions allowed the Manager to bind to the same source port 4167 for both IPv4 and IPv6 communication. But with the latest JRE version 1.7.0_45, it is no longer possible to do so, and the Manager uses port 4166 as the UDP source port to bind for IPv6. Manager 8.1 uses JRE version 1.7.0_51. If you have IPv6 Sensors behind a firewall, you need to update your firewall rules accordingly such that port 4166 is open for the SNMP command channel to function between those IPv6 Sensors and the Manager. Network Security Platform version 8.1 replaces 8.0 release. If you are using version 8.0 and require any fixes, note that the fixes will be provided in version 8.1. There will not be any new maintenance releases or hot-fix releases on version 8.0. With release 8.1, Network Security Platform no longer supports the Network Access Control module and N-series Sensors. If you are using Network Access Control with N-series (NAC-only) Sensors, McAfee recommends that you continue to use the version. If you are using the Network Access Control module in M-series Sensors, continue to use the version. That is, you should not upgrade the Manager or the Sensors to 8.1 for such cases. Manager software version 7.5 and above are not supported on McAfee-built Dell based Manager Appliances. 2

3 New features This release is to provide fixes for some of the previously known issues, and does not include any new features. Enhancements This release of Network Security Platform includes the following enhancements: Integration with McAfee Vulnerability Manager enhancements While integrating the Vulnerability Manager with Network Security Manager, in the Database configuration page of Running MVM Scans and Enhancing Alert Relevance, the Password field is cleared after you click Save. This feature has been incorporated as an additional security measure. If you wish to check the server connection for Vulnerability Manager, enter the Password again and then click Test Connection. Manager Infrastructure enhancements In this release, the version of MySQL bundled with the Manager is Resolved issues These issues are resolved in this release of the product. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Resolved Manager software issues The following table lists the medium-severity Manager software issues: ID # The Manager is vulnerable to Tomcat vulnerabilitites prior Automatically generated reports with Japanese characters have unreadable characters in the file name of the report and the title of the report The contact information cannot be saved in the Manager The All Tables backup is not completely exported The snort rule generates alerts for IP addresses that are not specified in the rule With heavy traffic and firewall rules configured, there is high CPU usage in an MDR pair Simulated blocking is disabled unexpectedly When performing Archive Now action under Manage Maintenance Alerts Archiving IPS Archive Now, the browser prompts to resubmit the form The Manager displays MySQL version as After disabling the Inherit Settings option in the Protection Profile page, the option remains enabled after a policy push When a non-standard port is configured to parse http protocol in the Non-Standard Ports page, the port setting displays incorrect port values The customized new UDS with an AttackID added overwrites an existing AttackID Due to malware policy name exceeding the 40 character limit, any changes made to the malware policy cannot be saved. 3

4 ID # While updating a firewall policy, the exception error Unable to Update Firewall Policy. Java.lang.NullPointerException is displayed when you select a rule object in the Firewall Policies page The user defined report generated in the Manager with the criteria as does not equal attack blocked displays the report for equals attack blocked The Manager service often causes high CPU usage of 99%. Resolved Sensor software issues The following table lists the high-severity Sensor software issues: ID # After upgrading to ESX 5.5 update 3, traffic does not pass in the virtual machine The Sensor sometimes reboots incorrectly because of incorrect low buffer available error. The following table lists the medium-severity Sensor software issues: ID # When additional packet logging is enabled, Sensor may stop sending alert or packet-logs to the Manager The Sensor is vulnerable against OpenSSH vulnerability CVE (increased brute force attacks which causes denial-of-service by bypassing MaxAuthTries) Exhaustion of internal resources, related to a system event, causes a failure to upload packet capture files from the Sensor to the Manager Concurrent use of logstat all command in the CLI and diagnostic trace upload from the Manager leads to denial of access to CLI After successful datapath auto-recovery, Sensor may go into an asynchronous state Sensor stops sending packet logs to the Manager when Layer 7 data collection is enabled Some OIDs for L7 data capture memory usage are missing Sensor goes to bad health due to exception in the malware processing engine / The Sensor might reboot or go into a hung state after running for days from when the Sensor was last power cycled. Any Sensor reboot initiated from the Sensor CLI or Manager UI, or Sensor software upgrade will not restart the uptime The output of show dospreventionprofile command may display the value for short-term traffic rate as 'zero packets per second' even when there is incoming or outgoing traffic on the Sensor Large number of small UDP packets, which triggers the UDP fast-forward threshold, causes the firewall rules to stop functioning The alert SENSOR: Host Entries for Connection Limiting Feature Exhausted is continuously displayed in the Threat Analyzer when Protection for Web Servers is enabled When L7 data collection is disabled, sometimes the maximum percentage of L7 Dcap flows shows incorrect usage statistics in the Sensor CLI show mem-usage When OS Fingerprinting and Layer 7 Data Collection are enabled, the Sensor might auto-recover or reboot depending on the configuration Records with are inserted at the beginning of a frame when packet logging is enabled for some attacks The Sensor forwards some inline packets ahead of others, causing certain applications to send TCP RST responses for packets that arrive out of order The Sensor at times fails to block the Utorrent/BitTorrent application. 4

5 ID # Unable to add IP address ending with.127 to the quarantine list The Sensor triggers alerts for IP addresses configured in the firewall policies to be ignored Re-assembly Buffer Memory Exhausted alert is seen due to internal resource exhaustion Several errors for GTI File Reputation query failures are displayed in the Sensor output and attack ID is not supported for syslog forwarding The Sensor is vulnerable to [CVE ] Ghost Vulnerability which is a heap-based buffer overflow that allows execution of arbitrary codes Internal SNMP communication error causes an exception resulting in Sensor auto-recovery Sensor stops sending files to Advanced Threat Defense appliance Sensors fails to perform a configuration update When Port Throughput Utilization in Performance Monitoring is enabled, disabling monitoring ports from the Manager is not possible Traffic is forwarded to SPAN ports after hitless reboot/auto-recovery The Sensor is not able to send the event logs to the syslog server on a custom UDP port. By default, it sends the logs on port Inactive user account are locked unexpectedly ARP packets are getting padded with additional 28 bytes The show gti stats file CLI command is deprecated. Information previously shown in the output of this command is now available in show GTI IP reputation statistics The Sensor may reboot after a long run due to exhaustion of system resources The Sensor detects HTTP: Web application server attack detected as a false positive alert. This issue is addressed in the signature set versions later than The Advanced Threat Defense dashboard sometimes displays hash value instead of the file name In an ACL summary alert, country name is missing for the source and destination IP addresses In rare occasions, the Sensor goes into a lockout condition which results in a hung state or reboot The User Defined Report in Traditional Report shows "McAfee NAC" for Alert/Attack Type The GTI alert connection from high risk internal IP is incorrectly triggered even when it is not present in the signature set Due to incorrect XFF parsing, the non-true client gets quarantined The Sensor can sometimes go to layer 2 or reboot when new configuration updates are deployed to the Sensor In rare scenarios, the Sensor may reboot or autorecover when multiple malware files are processed in the same flow The buffer leaks are seen when Advanced Traffic Inspection is enabled The deployment of Botnet update to the Sensor fails, due to which the Internal configuration error critical fault is generated The SNMP Get/Walk executed on the Sensor returns the SCP file server credentials Firewall policy does not block some HTTPS applications. 5

6 ID # The Sensor switches to layer 2 mode in certain scenarios during signature set/ configuration update After updating to the signature set version , false positive alerts are generated with the attack name ICMP: Nachi-like Ping 0x Offline signature set update fails in the Sensor Some malware alerts do not display the filename in the Manager report, Threat Analyzer and the Advanced Threat Defense console The Sensor management port is affected by shellshock vulnerability When quarantine is enabled in the connection limiting policy, the first quarantined host is not released after the specified release time ARP packets (matching the MAC flip flop event) are dropped which leads to network outage in rare scenarios. This happens when MAC flip flop attack is disabled and Heuristic Web Application Server Protection(WASP) is enabled on any interface of the Sensor After a Sensor name change, the $IV_SENSOR_NAME$ flag is not updated until Sensor reboot The Reconnaissance alerts are not filtered correctly when the attack filter contains rules as Any internal IP or Any external IP The Sensor reboots due to depletion of system memory The GTI queries fail since DNS resolution could not be configured Layer 7 data are missing for alerts generated by Advanced Threat Defense Sensor becomes unresponsive and causes traffic outage Signature set download to the Sensor fails because of the Invalid File Name or File not Found error The L3/L4 error count in SPAN port cannot be viewed even after it crosses the threshold limit The Sensor causes RST packets to be sent out of order During signature set update, the HTTP: Attempt to read password file attack may go undetected for a very short time. 6

7 Installation instructions Manager server/client system requirements The following table lists the 8.1 Manager server requirements: Operating system Minimum required Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, English operating system, SP1 (64-bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition, Japanese operating system, SP1 (64-bit) (Full Installation) Windows Server 2012 Standard Edition (Server with a GUI) English operating system Windows Server 2012 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) English operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) English operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) Japanese operating system Only x64 architecture is supported. Recommended Same as the minimum required. Memory 8 GB 8 GB or more CPU Server model processor such as Intel Xeon Same Disk space 100 GB 300 GB or more Network 100 Mbps card 1000 Mbps card Monitor 32-bit color, 1440 x 900 display setting 1440 x 900 (or above) The following are the system requirements for hosting Central Manager/Manager server on a VMware platform. 7

8 Table 5-1 Virtual machine requirements Component Minimum Recommended Operating system Any of the following: Windows Server 2008 R2 Standard or Enterprise Edition, English operating system, SP1 (64-bit) (Full Installation) Windows Server 2008 R2 Standard or Enterprise Edition, Japanese operating system, SP1 (64-bit) (Full Installation) Windows Server 2012 Standard Edition (Server with a GUI) English operating system Windows Server 2012 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) English operating system Windows Server 2012 R2 Standard Edition (Server with a GUI) Japanese operating system Windows Server 2012 R2 Datacenter Edition (Server with a GUI) English operating system Windows Server 2012 R2 Datacenter (Server with a GUI) Japanese operating system Only X64 architecture is supported. Same as minimum required. Memory 8 GB 8 GB or more Virtual CPUs 2 2 or more Disk Space 100 GB 300 GB or more Table 5-2 VMware ESX server requirements Component Minimum Virtualization software ESXi 5.0 ESXi 5.1 ESXi 5.5 Update 3 ESXi 6.0 Update 1 CPU Memory Internal Disks Intel Xeon CPU ES 2.00 GHz; Physical Processors 2; Logical Processors 8; Processor Speed 2.00 GHz Physical Memory: 16 GB 1 TB 8

9 The following table lists the 8.1 Manager client requirements when using Windows 7, Windows 8, or Windows 10: Operating system Minimum Windows 7 English or Japanese Windows 8 English or Japanese Windows 8.1 English or Japanese Windows 10 English or Japanese The display language of the Manager client must be same as that of the Manager server operating system. Recommended RAM 2 GB 4 GB CPU 1.5 GHz processor 1.5 GHz or faster Browser Internet Explorer 9, 10 or 11 Mozilla Firefox Google Chrome in not supported since the NPAPI plug-in is disabled by default and will not be supported by Google going forward. This means that Java applet support is also disabled by default. Internet Explorer 11 Mozilla Firefox or above For the Manager client, in addition to Windows 7 and Windows 8, you can also use the operating systems mentioned for the Manager server. The following table lists the 8.1 Central Manager / Manager client requirements when using Mac: Mac operating system Lion Mountain Lion Browser Safari 6 or 7 For more information, see McAfee Network Security Platform Installation Guide. Upgrade recommendations McAfee regularly releases updated versions of the signature set. Note that automatic signature set upgrade does not happen. You need to manually import the latest signature set and apply it to your Sensors. The following is the upgrade matrix supported for this release: Component Manager/Central Manager software Minimum Software Version , , (only for NS5x00), (only for XC-640 and NS3x00) Virtual IPS Sensor software

10 Known issues For a list of known issues in this product release, see this McAfee KnowledgeBase article: Manager software issues: KB81373 Virtual IPS Sensor software issues: KB82174 Product documentation Every McAfee product has a comprehensive set of documentation. Find product documentation 1 Go to the McAfee ServicePortal at and click Knowledge Center. 2 Enter a product name, select a version, then click Search to display a list of documents. 8.1 product documentation list The following software guides are available for Network Security Platform 8.1 release: Quick Tour Installation Guide Upgrade Guide Manager Administration Guide Manager API Reference Guide (selective distribution - to be requested via support) CLI Guide IPS Administration Guide Custom Attacks Definition Guide XC Cluster Administration Guide Integration Guide NTBA Administration Guide Best Practices Guide Troubleshooting Guide 10

11 Copyright 2016 McAfee, Inc. Intel and the Intel logo are trademarks/registered trademarks of Intel Corporation. McAfee and the McAfee logo are trademarks/ registered trademarks of McAfee, Inc. Other names and brands may be claimed as the property of others. 00