PGP(TM) Universal Server Version 3.2 Maintenance Pack Release Notes Thank you for using this Symantec Corporation product. These Release Notes contain important information regarding this release of PGP Universal Server. Symantec Corporation strongly recommends you read this entire document. Symantec Corporation welcomes your comments and suggestions. You can use the information in Getting Assistance to contact us. Product: PGP Universal Server Version: 3.2.0 MP 5 Warning: Export of this software may be restricted by the U.S. government. Note: To view the most recent version of this document, go to the Products section on the Symantec Corporation Web site. What's Included in This File About PGP Universal Server Changes in this release Additional Information Changed Functionality Technical Support Copyright and Trademarks About PGP Universal Server PGP Universal Server provides your enterprise with secure messaging by transparently protecting your messages without user interaction. It automatically creates and maintains a Self-Managing Security Architecture (SMSA) by monitoring authenticated users and their email traffic. You can also send protected messages to addresses that are not part of the SMSA. The PGP Universal Server encrypts, decrypts, signs, verifies messages, and provides strong security through policies you control. PGP Universal Satellite provides security for email messages up to the email user's computer, allows external users to become part of the SMSA, and provides end users the option to create and manage their keys on their computers. PGP Universal Server is a security tool that uses cryptography to protect your data against unauthorized access.
Changes in This Release This section lists the changes in this release of PGP Universal Server. What's Changed in This Maintenance Pack What's Changed in PGP Universal Server 3.2.0 MP 5 Resolved an issue where the option to force PGP Portable usage is now applied on the client. [2664385] Resolved the issue with PGP Desktop so that MAPI can decrypt any email for which the user has the private key, even if the user no longer has the specific X.509 certificate that the message was encrypted to. To enable this functionality, use the new hidden pref "mailsmimedecryptwithanykey". [2677388] Resolved the issue where custom PGP BootGuard text did not get applied. Note that when customizing the PGP BootGuard screen, enter a maximum of 79 characters (if using UTF-8 characters). Exceeding this number of characters results in a truncated line of text in the PGP BootGuard screen. [2660786] Resolved an issue so that advanced searches in Consumers > Devices now returns the correct results and no longer displays an error. [2552772] Resolved an issue where enrolled users with SKM keys were changed to GKM users. [2609726] Resolved an issue where the key usage flags were were not added correctly on a SKM wrapper key created from an externally signed X.509 certificate. [2661737] Resolved an issue so that upgrades from PGP Universal Server 3.2.0 MP3 now succeeds as expected. [2699527] Resolved the SSL CBC security vulnerability attack to limit the SSL ciphers in httpd and slapd (reference issue CVE-2011-3389). [2701292] Updated CentOS to resolve operating system vulnerabilities identified in PGP Universal Server 3.2 MP3. [2701782] Resolved the issue so that setting the WDE Administrator password in PGP Universal Server no longer causes client enrollment to fail with a bad parameters error. [2701786] Resolved an issue so that PGP Universal Web Messenger 3.2.0 MP2 users no longer receive an error when saving a reply. [2714752] Resolved the issues around deleting Sent messages from PGP Universal Web Messenger. [2717668] Resolved an issue that prevented PGP Universal Web Messenger 3.2.0 MP3 users from successfully sending messages to internal users when an ignition key was configured on the server. [2717684] Resolved an issue where the vertical scroll bar was missing from the print page of the PGP Universal Web Messenger mail. [2717687] What's Changed in PGP Universal Server 3.2.0 MP 4 Resolved the POSIX time problem where root CA s certificate might not have been valid beyond 19 th January 2038. [2457859]
Resolved the issue with PGP Universal Server where when upgraded, by default the display detailed authentication fields for bootguard was enabled. [2474627] Resolved the issue with PGP Universal Server where x509 keys on directory.verisign.com were not queried due to missing namingcontexts response. [2526018] Resolved the issue with PGP Universal Server where directory synchronization service was not resilient to java exceptions [2563668] Resolved the issue where Qualys vulnerability scan reported x-frame-options not being set. [2587717] Resolved the issue where Apache Version 2.2.19 and other versions were vulnerable to DOS attack [2602061] Resolved the issue with PGP Universal Server version 10.2 MP3 where WM mail insert time increased to O(N^2). [2620752] Resolved the issue where Webmessenger external LDAP authentication could match email-addresses from proxyadresses only in case "smtp:" was prepended [2626011] Resolved the issue with PGP Universal Server where key usage flags were removed and improperly added on a SKM pgp wrapper key created from externally signed x509 certificate [2656581] Resolved the issue with PGP Universal Server where the Preset Policy Group was ignored if Directory Synchronization was enabled [2656596] What's Changed in PGP Universal Server 3.2.0 MP 3 Resolved the issue that was causing PGP Web Messenger user s login to time out under light loads. [2517610] Resolved the issue with PGP Universal Server that was allowing duplicate data to exist in the database. [2563571] Resolved the issue with PGP Universal Server that was causing schema comparison errors after upgrade. [2577643] Resolved the issue with PGP Universal Server that would cause an error if the LDAP directory type was changed post migration. [2575114] Resolved the issue with PGP Universal Server that was causing PGP Universal Web Messenger users to see an error when logging in to their accounts. [2599562] Resolved the issue with PGP PDF Messenger that would cause users to be taken to a PGP Universal Web Messenger mailbox after resetting their passphrase. [2604013] Resolved the issue with PGP Universal Server that was causing issues with Blackberry devices when downloading a Certificate Revocation List (CRL). [2476465] Resolved the issue with PGP Universal Server that was allowing multiple instances of the replication process to be started. [2516130] Resolved the issue with PGP Universal Server that was preventing some XML preferences from being edited. [2481069] Resolved the issue with PGP Universal Server that was causing unexpected errors when viewing user accounts. [2476184] Resolved the issue with PGP Universal Server where PGP Remote Disable & Destroy was not generating any logs. [2476038]
Resolved the issue with PGP Universal Server where the PGP Remote Disable & Destroy Anti-Theft service was disabled and could not be started after a PUP update. [2476159] Resolved the issue with PGP Universal Server that was causing the replication of certain PGP Universal Web Messenger database records to be delayed by 90 seconds when under a light load. [2530050] Resolved the issue with PGP Universal Server that was causing debug logs to be displayed when debug logging was disabled. [2554233] Resolved the issue with PGP Universal Server that caused an error in a migration script when updating. [2603572] Resolved the issue with PGP Universal Server where database permissions would cause client policy to not download. [2598299] Resolved the issue with PGP Universal Server where the database schema was changed after update. [2604098] Resolved the issue with PGP Universal Server where a migration script failed during update. [2609251] What's Changed in PGP Universal Server 3.2.0 MP 2 Resolved the incompatibility issue with PGP Desktop and the newer 2011 (August 2011 and later) editions of MacBook Air and Mac mini computers. [2579318] What's Changed in PGP Universal Server 3.2.0 MP 1 Resolved the issue so that when the Recover Passphrase PDF Messenger default mail template is edited to specify HTML formatting, external users see the formatted HTML [31109/2476066]. Resolved the issue so that PGP Universal Satellite is now compatible with IMAP email accounts using Microsoft Outlook 2010 64-bit [31443/2476400]. Resolved the issue so that when an email is sent to a global distribution list with an invalid email address, this email is no longer stuck in Outbox. It is deleted from the Outbox [31492/2476449]. Resolved the issue so you can now use customized splash and start images for PGP BootGuard [31548/2489245]. Resolved the issue so that when you customize the PGP Universal Server on the Download PGP Clients page, the installed client connects to the correct customized PGP Universal Server [2493491, 2496315]. Resolved the issue so that your users' computers automatically encrypt after email enrollment to PGP Universal Server completes, if specified by policy [31378/2496536]. Resolved the issue so that when you access PGP Web Messenger using HTTP over port 80, it now redirects to using the secured HTTPS over port 443 [2509908]. Resolved the issue so that when you upgrade to PGP Universal Server 3.2, LDAP enrollment now works and users in custom groups are not moved to the Everyone group [2510210]. Several issues resolved to improve the performance of the PGP Universal Server, including improvements to user interface responsiveness when there is a large number of external users. [NBN]
PGP officially supports the NC382i NIC that ships by default on-board the HP ProLiant DL 380 G7 server. This information was omitted from the PGP Universal Server version 3.2 released documentation. Resolved the issue that resulted in the "Could not start disk encryption err: -12198" error being displayed on client systems when installing PGP Desktop using "silent' enrollment and when single sign-on and auto encrypt are enabled. [31509/2476466] Installing this Maintenance Pack Following are instructions for installing this maintenance pack release. Installing the PGP Universal Server Maintenance Pack PUP Update Before you install this maintenance pack: PGP Universal Sever 3.2 must be installed before the maintenance pack PUP update can be applied. The JDK update provided as part of PGP Universal Server 3.2 is no longer provided and is not required. To install the PGP Universal Server 3.2 maintenance pack update: 1. Log in to your PGP Universal Server administrative interface. 2. Select System > Updates. 3. Click Upload Update Package. 4. Select the PUP file and click Upload. 5. Click Install. Additional Information on This Maintenance Pack This section provides additional information. Also included are additional known issues in this maintenance pack release. For a list of issues in the 3.2.0 release, see the PGP Universal Server release notes. Updating from PGP Universal Server 3.2.0 MP 1 When updating your PGP Universal Server from 3.2.0 MP 1 to 3.2.0 MP3, the Upload Update pop-up window remains open and does not close after successfully uploading the PUP update file. To solve this problem, monitor the pop-up window to see that it periodically refreshes. Once it stops refreshing, close the pop-up window and refresh the main administrative console window. Enter your administrative credentials to access the PGP Universal Server again, and navigate to System > Updates and install the uploaded PUP file. [2609162]
Enabling or Disabling Encrypted Email This feature was omitted from the PGP Universal Server 3.2 documentation. On the Options page in your consumer policy, the Allow users to receive encrypted mail checkbox determines whether any PGP email messaging software can encrypt email to the primary keys that belong to users who follow the consumer policy. If the checkbox is selected, any PGP email messaging software can encrypt mail to that user. If it is deselected, and PGP software tries to encrypt mail to the user s key, the key not found (KNF) action in your mail granular policy is triggered, as if the email recipient had never had a key. The key can be found and only used for other purposes, for example by PGP NetShare, but not email encryption. Note: When you migrate to PGP Universal Server 3.2, the default setting is the same as the one for PGP Desktop Email Messaging. Users who upgrade to PGP Universal Server 3.2 need to verify that the setting is appropriate for them. For a new installation of PGP Universal Server 3.2, you must verify that the Allow users to receive encrypted mail checkbox is selected to reflect the encryption needs of the affected policy group. To enable or disable encrypted emails: 1. Select Consumer > Consumer Policy. 2. Click Default. 3. In the Keys panel, click Edit. 4. Click the Options tab. 5. Do one of the following: o To allow encrypted email, select the Allow users to receive encrypted mail checkbox. o To prevent encrypted email, deselect the Allow users to receive encrypted mail checkbox. 6. Click Save. Additional Known Issues "Error installing update" message. When you update PGP Universal Server to a 3.2.0 maintenance pack, a message "Error installing update" is displayed. This message is displayed in error, as the update is installed correctly. To prevent this message from displaying, use the following procedure: 1. Log in to your PGP Universal Server administrative interface and select System > Updates. 2. Upload the 3.2.0 maintenance pack PUP file using the PGP Universal Server administrative interface. 3. Select System > General Settings. 4. Click Stop All Services. Be sure you receive the notification that "The services have been stopped successfully" before proceeding. 5. Install the 3.2.0 maintenance pack PUP file you uploaded in step 2. "Schema did not match" error. After updating from PGP Universal Server 3.1.2 to 3.2, a migration error appears: "The default cannonical schema did not match the
PGP Universal schema." This is a warning message in the administrative console. For instructions on how to clear this message, contact Symantec Support. [2496505] Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s support offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and/or Web-based support that provides rapid response and up-to-theminute information Upgrade assurance that delivers software upgrades Global support purchased on a regional business hours or 24 hours a day, 7 days a week basis Premium service offerings that include Account Management Services For information about Symantec s support offerings, you can visit our Web site at the following URL: www.symantec.com/business/support/ All support services will be delivered in accordance with your support agreement and the then-current enterprise technical support policy. Contacting Technical Support Customers with a current support agreement may access Technical Support information at the following URL: www.symantec.com/business/support/ Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product release level Hardware information Available memory, disk space, and NIC information
Operating system Version and patch level Network topology Router, gateway, and IP address information Problem description: o Error messages and log files o Troubleshooting that was performed before contacting Symantec o Recent software configuration changes and network changes Licensing and registration If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: www.symantec.com/business/support/ Customer service Customer service information is available at the following URL: www.symantec.com/business/support/ Customer Service is available to assist with non-technical questions, such as the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs or manuals Support agreement resources If you want to contact Symantec regarding an existing support agreement, please contact the support agreement administration team for your region as follows: Asia-Pacific and Japan Europe, Middle-East, Africa North America, Latin America customercare_apac@symantec.com semea@symantec.com supportsolutions@symantec.com Copyright and Trademarks
Copyright (c) 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, PGP, Pretty Good Privacy, and the PGP logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.