Security Content Update Release Notes for CCS 11.1 and CCS Versions: CCS 11.1 and CCS 11.5

Transcription

1 Security Content Update Release Notes for CCS 11.1 and CCS 11.5 Versions: CCS 11.1 and CCS 11.5

2 SCU Release Notes for CCS 11.1 and CCS 11.5 Legal Notice Copyright 2017 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. Symantec Corporation 350 Ellis Street Mountain View, CA

3 Technical Support Contacting Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s support offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and/or Web-based support that provides rapid response and up-to-the-minute information Upgrade assurance that delivers software upgrades Global support purchased on a regional business hours or 24 hours a day, 7 days a week basis Premium service offerings that include Account Management Services For information about Symantec s support offerings, you can visit our website at the following URL: All support services will be delivered in accordance with your support agreement and the then-current enterprise technical support policy. Customers with a current support agreement may access Technical Support information at the following URL: Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product release level Hardware information

4 Available memory, disk space, and NIC information Operating system Version and patch level Network topology Licensing and registration Customer service Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: support.symantec.com Customer service information is available at the following URL: Customer Service is available to assist with non-technical questions, such as the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs, DVDs, or manuals

5 Support agreement resources If you want to contact Symantec regarding an existing support agreement, please contact the support agreement administration team for your region as follows: Asia-Pacific and Japan Europe, Middle-East, and Africa North America and Latin America

6 Contents Technical Support... 3 Chapter 1 Prerequisites for Security Content Updates... 7 Prerequisites... 7 Chapter 2 What's New... 9 New features... 9 New technical standards Updated technical standards Deprecated technical standards New regulatory framework Addition in predefined platforms Modified files Chapter 3 Resolved Issues Resolved issues Chapter 4 Known Issues Known Issues... 21

7 Chapter 1 Prerequisites for Security Content Updates This chapter includes the following topics: Prerequisites Prerequisites The following are the prerequisites to install the Security Content Updates: Symantec Control Compliance Suite 11.1 or later versions Before you install the Security Content Update (SCU), you must have Symantec Control Compliance Suite 11.1 or later versions installed on your computer. Note: Features such as Support for Script-based custom checks and Agent-based Data collection support for File Watch entity for Windows and UNIX platforms will be available after you upgrade to CCS 11.5 (Product Update ). Data collection support for Generic Devices data collector will be available after you upgrade to CCS (Product Update ). New signing certificate for CCS files A new signing certificate is used for all CCS files that are signed after February 23, Before you install the SCU, you must install the updated CCS certificate information necessary to validate the new signing certificate. For this update, you must install either of the following: Quick Fix To install the SCU or later, you must apply the Quick Fix

8 Prerequisites for Security Content Updates Prerequisites 8 The Quick Fix includes the Symantec.CSM.AssemblyVerifier.dll, which contains the updated CCS certificate information necessary to validate the certificate. You can download the Quick Fix from the following location: Symantec Control Compliance Suite 11.5 (Product Update ) This Product update recognizes and validates Symantec binaries that are signed by using the new certificate, in addition to recognizing the older binaries.

9 Chapter 2 What's New This chapter includes the following topics: New features New technical standards Updated technical standards Deprecated technical standards New regulatory framework Addition in predefined platforms Modified files New features The Security Content Update (SCU) contains the following enhancements: Data collection support for Generic Devices data collector Data collection support for Windows Server 2016 Data collection support for Oracle databases on RHEL 7 assets Data collection support for Generic Devices data collector Agentless data collection support for generic devices platform is available from SCU onwards. With this support, you can assess the security configuration posture of SSH protocol-compliant devices in your environment such as routers, gateways, switches, security devices, and web-based applications. This data collection, evaluation, and reporting capability is compatible with any SSH protocol-compliant devices and can be used on the operating systems such as: Cisco IOS

10 What's New New features 10 Junos OS UNIX Note: The devices for which you want to use the Generic Devices data collector must be added to the CCS asset system as an asset type called Devices. By using this functionality, you can create CCS standards comprising command-based checks to collect data required for the assessment. The command used in a check must be whitelisted so that it is considered during data collection. You can copy-paste and import-export the checks to share the functionality across your environment. Prerequisites The following are the prerequisites for using the Generic Devices data collector: CCS (Product Update ) CCS license for network devices User in the CCS Administrator role to whitelist commands and to add commands to checks User in the CCS Administrator or Standards Administrator role to create standards and command-based checks SSH port (22 by default or customized port) must be accessible from CCS Manager. If you are using customized SSH port, the port number must be added manually in the Asset-type Properties in the Assets workspace in the CCS Console. Note: If you do not specify the customized SSH port number in the Asset-type Properties, the default port 22 is considered, and data collection fails. See Addition in predefined platforms on page 12. For feature demonstration, watch this video. Note: For more information, refer to the Data collection support for Generic Devices topic in the Security Content Update Getting Started Guide (Versions: CCS 11.1 and CCS 11.5).

11 What's New New technical standards 11 Data collection support for Windows Server 2016 Data collection support for computers that are running on Windows Server 2016 is available from SCU onwards. The Security Essentials for Windows 2016 standard is provided in the Predefined folder in the tree pane of the CCS Standards view. By running this standard, you can assess the compliance posture of the Windows Server 2016 assets in your environment. Currently, Windows Server 2016 assets with the Windows Server (Server with Desktop Experience) installation are supported in CCS. This support is available for both agentless and agent-based modes of data collection. Agent-based support will be available after you upgrade to CCS (Product Update ). Data collection support for Oracle databases on RHEL 7 assets Data collection support for Oracle databases that are installed on RHEL 7 assets is available from SCU onwards. New technical standards The SCU contains the following new technical standards: CIS Benchmark for Microsoft Windows Server 2012 R2, v2.2.0 CIS Red Hat Enterprise Linux 7.x Benchmark, v2.1.0 CIS Benchmark for Oracle Database Server 12c, v1.2.0 Security Essentials for Windows 2016 Updated technical standards The following predefined standard is updated in SCU : Table 2-1 Predefined standard updated in SCU Standard VMware Hardening Guidelines ESXi 5.x via vcenter What is new? The following checks are added in the Host console section of this standard: Is Active Directory used for local user authentication? Is ESXi host firewall configured to restrict access to services running on the host?

12 What's New Deprecated technical standards 12 Deprecated technical standards The following technical standards are deprecated from SCU onwards: CIS Microsoft Windows Server 2012 V Security Essentials for Red Hat Enterprise Linux 7.x Security Essentials for Oracle Database Server 12c CIS Security Benchmark for VMware ESX 4.1 v1.0.0 via Unix Security Essentials for VMware ESX 4.1 via vcenter Security Essentials for VMware ESX Server 4.x via Unix VMware Hardening Guidelines ESX 4.x via Unix VMware Hardening Guidelines ESXi 4.x via vcenter CIS Red Hat Enterprise Linux 6.x Benchmark v1.2.0 Security Essentials for AIX 7.1 New regulatory framework The SCU contains the following new regulatory framework: Payment Card Industry (PCI) Data Security Standard (version 3.2) PCI DSS version 3.2 is an incremental revision of version 3.1. The updated standard contains five additional sub-requirements for service providers. This revision also underlines the importance of the use of multi-factor authentication for non-console administrative access from within the entity s network. Multi-factor authentication requirement for remote access (access originating from outside the network) was already covered in PCI DSS 3.1. Addition in predefined platforms SCU contains the following enhancements in the predefined platforms:

13 What's New Addition in predefined platforms 13 Table 2-2 Platform Enhancement Enhancements in predefined platforms Generic Devices The Generic Devices platform is added for data collection support for Generic Devices data collector. This platform contains the following entities: Device This entity reports various attributes of the Generic Device in your environment. Commands This entity allows execution of commands on devices. The following fields are supported for data collection for the Device entity: IPAddress This field returns the IP address of the asset selected for data collection. Operating System This field returns the operating system running on the asset. Operating System Version This field returns the operating system version running on the asset. SSH Port Number This field returns the port number of SSH. The following fields are supported for data collection for the Commands entity: IPAddress This field returns the IP address of the asset selected for data collection. Command Text This field returns the specified command. Command Association ID This field returns the command association ID for a query. Command Standard Output This field returns the standard output of the command. Command Standard Error This field returns the standard error of the command. Command Return Code This field returns the return code of the command. Record ID This field returns the record ID. UNIX The following fields are added to the Packages entity: Patch Release Issued This field returns the date on which the patch was released. Patch CVE Information This field returns the information about the CVE that is addressed by the patch.

14 What's New Modified files 14 Table 2-2 Platform VMware Enhancement Enhancements in predefined platforms (continued) The following field is added to the ESX Firewall entity: Allowed IP Addresses This field returns the IP addresses that are allowed in the firewall rules. The following fields are added to the ESXi Machines entity: Domain Name This field returns the name of the domain to which the host is added. Is Active Directory Authentication Enabled? This field returns 'True' if the Active Directory Authentication is enabled for the host. Modified files The following files are modified in SCU : GenericDevices.Schema.dll GenericDevicesScopes.dll Unix.Schema.dll UnixScopes.dll Symantec.CSM.Content.Localization.Resources.dll Symantec.CSM.CredentialMgmt.PlatformCredentials.dll Symantec.CSM.WindowsPlatformContent.CISIISv1.0.dll VMware.Schema.dll Symantec.CSM.WindowsPlatformContent.ListFieldChecks.dll Symantec.CSM.UnixPlatformContent.RHELv1.0.5.dll Windows.Schema.dll Symantec.CSM.UnixPlatformContent.HPUXv1.3.1.dll ORCL.Schema.dll WntScopes.dll Note: The version number for all the files mentioned earlier is

15 Chapter 3 Resolved Issues This chapter includes the following topics: Resolved issues Resolved issues Table 3-1 lists the resolved issues for SCU Table 3-1 Resolved Issues in SCU Issue The Remediation section of the Are Login and Logout Events recorded? check in the CIS Red Hat Enterprise Linux 6.x Benchmark v1.2.0 (Deprecated) standard displayed incorrect information. Resolution Now, the information is rectified. In the Query result details section, the same MD5 checksum was returned both for directories and zero byte files. The issue occurred because directories were treated as zero byte files, and hence the MD5 checksum for directories was same as the MD5 checksum for zero byte files. The code is modified to resolve this issue. Now, in the Query result details section, in the MD5 Check Sum column, the Not Applicable status is displayed for directories.

16 Resolved Issues Resolved issues 16 Table 3-1 Issue Resolved Issues in SCU (continued) Resolution A query created for group membership analysis for the Users entity for Windows platform returned data only for the first domain that was queried after each time the Symantec Data Processing Service was restarted. The issue occurred because multi-domain subsequent data collection was not supported. Agentless data collection for the CIS Security Benchmark for HP-UX v1.3.1 standard did not return any results. The data collection job timed out because a long command was getting truncated abnormally during execution on the asset. During agent-based data collection for an MSSQL Server asset, irrespective of the cause of authentication failure, the following generic error message was displayed: "Authentication failed for {Domain\user} because: The parameter is incorrect." The Asset Import job stopped working for raw data collection on the Oracle assets that are installed on Solaris with Intel processor. The issue occurred because the following command failed on the Solaris default shell (/bin/sh) due to which the Oracle asset import was unsuccessful: ps -eo "pid,args" grep pmon grep -v "grep" while read Instances; do instanceid=$(echo $Instances awk -F" " '\{print $1\}'); instancename=$(echo $Instances awk -F" " '\{print $2\}'); OraHome=$( pwdx $instanceid awk -F" " '\{print $2\}'); echo $instancename=$orahome; done Now, the code is modified to support multi-domain subsequent data collection. Now, the long command is replaced by multiple shorter commands and the code is modified. As a result, agentless data collection for the CIS Security Benchmark for HP-UX v1.3.1 standard returns the expected results. Now, the error code is modified and hence, the exact cause of authentication failure is displayed. Now, the command on the Solaris default shell is modified. Now, you can successfully import Oracle assets installed on Solaris with Intel processor.

17 Resolved Issues Resolved issues 17 Table 3-1 Issue Resolved Issues in SCU (continued) Resolution Oracle assets that were installed on Solaris could not be imported to CCS asset system if the Oracle listener was configured by using TNS_ADMIN parameter. If the TNS_ADMIN parameter was not present on the target environment, it was not considered during asset import and as a result, the import failed. Now, the TNS_ADMIN parameter is handled in the code and is not required to be present on the target environment. Hence, you can successfully import the Oracle assets to CCS asset system. The following checks in the CIS Benchmark v1.1.2 for Red Hat Enterprise Linux 5.0 and 5.1 standard contained incorrect static content: Incorrect static content is rectified. No duplicate uids exist in /etc/group? No duplicate uids exist in /etc/passwd? No duplicate usernames exist in /etc/passwd? The Query Baseline job for the Installed Software Features entity for the Windows platform failed and the following error message was displayed: Incorrect syntax near ). Now, the missing primary fields in the Windows.Schema.dll file are added. Now, you can run the Query Baseline job for the Installed Software Featuresentity for the Windows platform successfully. The issue occurred because the primary fields that were required for data collection for the Installed Software Features entity were missing in the Windows.Schema.dll file. The string name for the Network security: Force Disconnect of Remote Users after hours? field did not match the security option name Network security: Force logoff when logon hours expire in Windows Group Policy settings. The discrepancy is removed. On an RHEL 5.11 asset, after a CER job was run against the CIS Benchmark v1.1.2 for Red Hat Enterprise Linux 5.0 and 5.1, the checks for the Packages entity in UNIX platform reflected the Error status in the evaluation result details. The code has been modified to resolve this issue. Now, data collection for the checks for the Packages entity in UNIX platform is completed without any check reflecting the Error status.

18 Resolved Issues Resolved issues 18 Table 3-1 Issue Resolved Issues in SCU (continued) Resolution Data collection and evaluation for the following check in the Security Essentials for Microsoft IIS 8.0 and 8.5 standard returned incorrect results: Now, the check algorithm is modified to match the iiswaskey key correctly and hence the data collection returns correct results Are Encryption Providers set to Locked Down? The issue occurred because during data collection for the IIS check, all the permission keys in the Machinekeys directory were evaluated instead of matching the iiswaskey key only. The Is Reschedule Automatic Updates scheduled installations set to Enabled? check in the CIS Security Configuration Benchmark For Microsoft Windows Server 2008 and Windows Server 2008 R2 v1.1.0 standard reflected the Not Applicable evaluation status when data was missing. The check was expected to fail in this case. The issue occurred because of the irrelevant precondition set for the check, because of which the check outcome was set to Not Applicable. Now, the irrelevant precondition is removed, and hence, the check fails when the required data is missing. ESXi asset import and data collection failed after vcenter was upgraded to 5.5 Update 3e. Now, the reference to OpenSSL library is rectified and hence, the ESXi asset import and data collection work with the vcenter 5.5 Update 3e. The Collection-Evaluation-Reporting (CER) job, which was run on Windows assets, intermittently reflected the Unknown status when the dissolving agent collected the Audit Policy data. The code is modified to resolve this issue. Now, the data collector returns the Audit Policy results consistently.

19 Resolved Issues Resolved issues 19 Table 3-1 Issue Resolved Issues in SCU (continued) Resolution Data collection queries for the CIS Red Hat Enterprise Linux 6.x Benchmark v1.2.0 and the CIS Red Hat Enterprise Linux 6.x Benchmark v1.4.0 standards timed out and an error message similar to the following was displayed: Error: Command timed out in execution: sudo -S -E env PATH=/bin:/usr/ bin:/usr/sbin:/sbin:/usr/local/bin:/bin:/ usr/bin:/usr/sbin:/sbin:$path find /* -name "*" \( -fstype nfs -o -fstype autofs -o -fstype proc \) -prune -o \( -nouser -o -nogroup \) /null Oracle-configured database assets could not be imported from HP-UX machines. After the completion of the Asset Import job, the following error message was displayed in the BVOOSStrategies.log file on the CCS manager: Error: Platform = HP-UX not Supported. The issue occurred because backward compatibility of the HP-UX platform support was broken. During SLES agent installation, the /bin/cut and the /bin/sed binaries were missing at the expected locations on SUSE machines. Even though the agent was installed and registered with CCS successfully, the warning message about the missing cut and sed binaries was displayed during installation. A query run for the Users entity for Windows platform did not return results for the Group Membership <LIST> field, and the following message was displayed in the Query result details pane: Not Set or No Read Permission The exclusive query option in the CIS Red Hat Enterprise Linux 6.x Benchmark v1.4.0 standard XML is set to 'True' for the checks in which the Unix.File.FindOptions attribute is used. As a result, the data collection query is completed successfully. Note: The XML changes are done only for the CIS Red Hat Enterprise Linux 6.x Benchmark v1.4.0 standard, because the CIS Red Hat Enterprise Linux 6.x Benchmark v1.2.0 standard is deprecated. Backward compatibility for the HP-UX platform support is reestablished and now, Oracle-configured database assets are imported from Hp-UX machines successfully. The code is modified to resolve this issue. Now, no warning message about missing cut and sed binaries is displayed during agent installation. The code is modified to resolve this issue. Now, the query returns the list of group names correctly.

20 Resolved Issues Resolved issues 20 Table 3-1 Issue Resolved Issues in SCU (continued) Resolution Data collection for the FSMO Role: PDC Emulator? field in the Machines entity for Windows platform returned the Not Applicable status in the Query result details pane. Data collection for the Oracle platform failed when additional processes with similar naming convention as PMON instances were present on a target machine. Data collection support for agentless NetBIOS-disabled Windows target machines did not work when the domain DNS suffix in the Domain FQDN field in the Windows domain cache credential configuration wizard was specified. An error message similar to the following was displayed: DomainDN() failed on ::ADsOpenObject() for the object LDAP://<DOMAIN>. Error : The server is not operational. - Unspecified error The code is modified to resolve this issue. Now, data collection for the FSMO Role: PDC Emulator? returns the accurate results. The code has been modified to ignore the unnecessary processes that are running on the target machine during data collection, and hence, data collection is successful. The code is modified to resolve this issue. Now, the data collection support for agentless NetBIOS-disabled Windows target machines works as expected. See Known Issues on page 21.

21 Chapter 4 Known Issues This chapter includes the following topics: Known Issues Known Issues The following known issue is observed in SCU : Issue During raw data collection (RBC) (in both agentless and agent-based modes) and message based collection (MBC) for checks related to password comparison, an error message similar to the following is observed: PWDump::GetRemoteHashes() - PrivateGetPasswordBatchFromPWHashDumpServiceOnRemoteMachine() failed with error 0x000006D3 for <machine name>. Error: The authentication service is unknown. Cause The MS security patch that is installed on the target Windows assets blocks the retrieval of password hashes that are used in various password comparison checks in Control Compliance Suite (CCS) and Enterprise Security Manager (ESM). Solution At this time, we do not see any solution to this issue. Symantec does not recommend removal of MS because it is a prerequisite for future critical OS patches (See KB ) However, if you enforce proper password complexity policies on your Windows computer (which CCS and ESM can verify via RBC and MBC checks), password comparison checks become much less relevant.

22 Known Issues Known Issues 22 For more information about this issue, see the article published at the following location: Examples of affected checks The following are the examples of password comparison checks (both RBC and MBC) that are affected after you install the MS security patch on your Windows computer: Table 4-1 RBC Examples of checks affected because of MS patch MBC (ESM) Password Is User Name? Password Found in File? Password Is Blank? Password is Any User Name? Password = username Password = any username Password=wordlist word Reverse Order Double occurrences Plural Prefix Suffix