Release Notes Revision B McAfee Data Loss Prevention 9.2.2 Contents About this release Enhancements Resolved issues Installation instructions Known issues Find product documentation About this release Thank you for choosing McAfee Data Loss Prevention (McAfee DLP). This document contains important information about the current release. We strongly recommend that you read the entire document. McAfee DLP version 9.2.2 introduces feature enhancements and resolves issues present in the previous release. You must have version 9.2.0 or 9.2.1 installed on your target system before installing version 9.2.2. The 9.2.2 patch release does not support coexistence with previous versions. Therefore, in a managed environment, all appliances must be upgraded to version 9.2.2 at the same time. For virtual appliance installation instructions, see the McAfee Data Loss Prevention Virtual Appliance Installation Guide. Modules included This release includes the following module versions: McAfee Data Loss Prevention Manager 9.2.2 McAfee Data Loss Prevention Monitor 9.2.2 McAfee Data Loss Prevention Discover 9.2.2 McAfee Data Loss Prevention Prevent 9.2.2 McAfee Data Loss Prevention Endpoint 9.2.201.4 The McAfee DLP Endpoint extension for McAfee epolicy Orchestrator in this patch release is hdlp_extension_9.2.201.4, which is compatible with Unified McAfee DLP (UDLP) on epolicy Orchestrator 4.5 and 4.6. Supported systems The following operating system and platform versions are supported: 1
McAfee Linux Operating System 1.1.5 (McafeeNDLPmlos 1.1.5 1.x86_64.rpm) McAfee DLP 4400 appliance Fedora 3 Linux Operating System McAfee DLP 1650/3650 appliances VMware vsphere ESX 4.x, ESXi 5.x Virtual appliances Compatible McAfee point products The following McAfee point product versions were tested for compatibility with McAfee DLP 9.2.2 software: McAfee epolicy Orchestrator 4.5, 4.6 McAfee Web Gateway 6.x, 7.x McAfee Email Gateway 7.x McAfee Logon Collector 1.x, 2.0 Supported repositories McAfee DLP Discover supports the following database repositories: DB2 5x iseries, 6.1 iseries, 7.x 9.x Microsoft SQL Server 2000, 2005, 2008, 7.0, MSDE 2000 MySQL (Enterprise) 5.0.x, 5.1 Oracle 8i, 9i, 10g, 11g EMC Celerra 5.6 McAfee DLP Discover supports the following file systems and servers: EMC Documentum 5.3, 6.0, 6.5 Microsoft SharePoint 2003, 2007, 2010 FTP HTTP/HTTPS NFS (Network File System) CIFS (Common Internet File System) Microsoft Windows Server 2003, 2008, 2008 R2 cluster Microsoft Windows XP Professional SP3 or later (32 bit) Microsoft Windows Vista SP1 or later Enterprise and Business editions (32 bit) Microsoft Windows 7 SP1 or later (32 and 64 bit) Supported browsers McAfee DLP supports the following third party browsers. These versions were tested for compatibility with the software: Microsoft Internet Explorer 6, 7 Mozilla Firefox 3.0.x 2
Supported languages McAfee DLP supports the following languages in scanned content: English Italian Chinese (Traditional) Japanese Chinese (Simplified) Korean Hebrew Russian Arabic Dutch French Greek German Hungarian Spanish Czech Portuguese Turkish Enhancements This release includes these enhancements. Disaster recovery backup and restore This release includes support for: Scheduled backups Migrating a McAfee DLP Manager or standalone McAfee DLP appliance from a model 1650 or 3650 appliance to a model 4400 or virtual appliance, and from a virtual appliance to a model 4400 appliance McAfee DLP Discover scans This release includes support for: SharePoint scans with NTLMv2 authentication HTTP and HTTPS scans with NTLM v2 authentication Scanning Windows 2008 R2 cluster servers Webmail support This release includes additional webmail support for these providers: 126.com rediff.com 163.com sina.com qq.com sohu.com McAfee DLP Discover reports Scan statistics reports generate in the background, allowing you to navigate the user interface while the report completes. 3
McAfee DLP Endpoint incidents McAfee DLP Manager includes enhanced functionality when importing selected McAfee DLP Endpoint incidents into the unified McAfee DLP incident manager. Custom logos in reports You have the option to replace the default McAfee logo in incident reports with a different image. Resolved issues These issues are resolved in this release of the product. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Dashboards and incidents Resolves the incident details page displaying user names as "unknown" if the total number of Active Directory (AD) users exceeded 100,000; memory for AD user attributes is increased to support up to 800,000 keys and up to 200,000 AD users (780540) Resolves the incident details page displaying user names as "unknown" for SMTP connections where the header FROM field contained certain encoding (786199) Resolves the incident dashboard match count displaying zero even though the detail view displayed matches (795246) Resolves the top ten recipients dashboard displaying more than ten results (795528) Resolves incorrect mapping in the related incident results when updating incident details, such as the resolution or severity (810798) Corrects an error stating that an incident detail selected on McAfee DLP Manager had been deleted, even though the incident was on the managed device (813694) Resolves an issue when a scheduled report containing incidents with text in Chinese, Japanese, or Korean characters was sent using email, these characters were replaced with question marks in the email; the character set uses UTF 8 for the email subject and body message (815770) Resolves an issue when viewing the incident details for the DocReg concept, the concept count did not display correctly if additional concepts were also matched (825422) McAfee DLP Discover scans Adds support for scanning Windows 2008 R2 cluster servers (725612) Adds support for NTLMv2 authentication (760909) Adds support for crawling SharePoint 2010 Web Part links (763953) Improves CIFS scans when the repository becomes unavailable during the scan; the number of scan retries is increased and a delay is added between retries (789977) Corrects an error with match string details when viewing scan results (824844) 4
Policy and rules Resolves an issue when the document properties feature was used to search Microsoft Excel files, keywords and other properties would not trigger any rules (793756) Resolves an issue when a rule or policy associated with registered documents was deleted, attempts to access registered documents would fail (806928) Scanned content Fixes the text extractor from becoming unresponsive when extracting a Microsoft Word 2003 OLE format file encoded with NONE UTF 8 characters; Microsoft Word 2003 OLE format files encoded with NONE UTF 8 characters are not scanned (791185) Resolves missing file property fields, such as GPL Ghostscript, when extracting text from a PDF file (793277) Resolves an issue where RAR archive files attached to an incident assigned to a case would not successfully open in Internet Explorer (793641) Fixes incorrect keyword matching in a file when the keyword was at the end of the file without a carriage return (807562) Resolves a system process failure when extracting 7 zip files with no content (796185) Searches Resolves a system process failure when search parameters contained certain special characters (780879) Fixes inconsistent results when performing capture searches from McAfee DLP Manager (795430) Resolves a text wrapping issue when specifying a long device name in an advanced search; a horizontal scroll bar appears to prevent text from wrapping (803078) System Managed devices Corrects an error when McAfee DLP Manager is unavailable and users attempt to log on to a managed McAfee DLP appliance using a failover account (799128) Resolves a synchronization issue when a rule or policy could not be pushed from McAfee DLP Manager; an option to forcibly publish policy configuration to managed devices is added (804908) Corrects an error when using special characters in the password, such as $, to register a device to McAfee DLP Manager (814777) SNMP Resolves an issue where the SNMP (dlpmon) daemon did not automatically start after being stopped (823536) Resolves an issue where SNMP did not detect power failures (831295) Other Resolves an issue where configuring a network interface through the user interface did not perform the configuration as expected (781511) Resolves a system process failure when a new network filter contained more than 500 characters; length validation is added for input parameters (785402) Adds support for special characters in the Base DN field for LDAP servers (813478) 5
Corrects an error that occurred when upgrading if an encrypted file needed removal from quarantine (814355) Fixes the logon page appearance when the Internet Explorer language setting was configured for Japanese; the logon page is displayed in English for all language settings (815381) Resolves incorrect labels for the file size in the data classification view (818105) Resolves an issue where McAfee DLP Prevent stopped processing emails because an application log file had grown too large; the log file size has been limited (820684) Resolves audit log access from the user interface (829731) Resolves arbitrary file read accesses from the user interface (829733) Resolves verbose error messages appearing in the user interface (829735) Resolves unintended exposure of functionality in the user interface (829740) Resolves the logon page accepting arbitrary values for the Domain field (829742) Resolves an upgrade failure when a McAfee DLP Discover scan task was configured to use SSL certificates (849632) Installation instructions To install version 9.2.2, upgrade your appliance. Tasks Upgrade the products on 4400 appliances on page 6 If your product is at version 9.2.0 or 9.2.1, you can upgrade directly to 9.2.2. Upgrade the products on 1650 or 3650 appliances on page 8 If your product is at version 9.2.0 or 9.2.1, you can upgrade directly to 9.2.2. Upgrade the products on 4400 appliances If your product is at version 9.2.0 or 9.2.1, you can upgrade directly to 9.2.2. Before you begin Download the product archive and copy it to the appliance. Stop all scans and search tasks, and wait until they are completely stopped. If you are running version 9.2.0 on a McAfee DLP Manager or a standalone McAfee DLP product on a model 4400 appliance, and you want to perform a backup before upgrading, you must apply hotfix 754037_45668_01. McAfee recommends performing frequent backups. Without a backup, the data, settings, and configuration on your appliance might be lost in the event of a system failure. To upgrade a product on the 4400 appliance, you must install the new image on the disk that is not used by the previous installation. This ensures that the original image can still be accessed after the upgrade is complete. The system automatically boots from the latest image. The install_to_pri and install_to_sec scripts install the upgrade. After the process runs, the existing configuration and database are copied to the new image. If you use the wrong script, you will write over your existing installation. 6
Task 1 Log on as root to the model 4400 appliance. 2 Copy the archive to the appliance. If you downloaded the archive to a Windows based computer, use WinSCP. If you are copying the archive from a Linux server, use the SCP command scp rp <package number> root@<name or ip address>:<directory> 3 Make an installation directory. # mkdir /data/install 4 Find out which version is currently installed. # cat /data/stingray/etc/version 5 Run the system_info utility to determine whether the system is running the product from the primary or secondary image, so that you can decide where to install the update. # /data/stingray/ksh/system_info Install the update on the disk that is not used. For example, if system_info returns the message "The system is currently running <product> from the primary image," install the update on the secondary disk with install_to_sec. 6 From the directory you downloaded the archive to, extract the contents of the archive, using the C option to expand it into the /data/install directory. # tar xvzf ndlp_<product>.tgz C /data/install 7 Go to the /data/install directory. # cd /data/install 8 Run the installation script. Before you type the command, run pwd to establish that you are in the correct product directory. You must be sure that you are running the updated scripts in the upgrade archive that you just downloaded and extracted. iguard was the original name of McAfee DLP Monitor, but the archives have not been renamed, and each product name is preceded by i to maintain the original naming convention. #./install_to_pri <product>. or #./install_to_sec <product>. The product image installs on the primary or secondary disk. When the upgrade is complete, a message appears stating which image will boot next. 9 Restart the system. # reboot Restarting the system might take 10 15 minutes. 7
10 Log on to the McAfee DLP device as root, go to the installation directory, and verify the installation with the command: # cat /data/stingray/etc/version If the Release field contains 9.2.2, installation is complete. Upgrade the products on 1650 or 3650 appliances If your product is at version 9.2.0 or 9.2.1, you can upgrade directly to 9.2.2. Before you begin Download the product archive and copy it to the appliance. Stop all scans and search tasks, and wait until they are completely stopped. McAfee recommends performing a backup before upgrading. Without a backup, the data, settings, and configuration on your appliance might be lost in the event of a system failure. Task 1 Log on as root to the 1650 or 3650 appliance. 2 Copy the archive to the appliance. If you downloaded the archive to a Windows based computer, use WinSCP. If you are copying the archive from a Linux server, use the SCP command scp rp <package number> root@<name or ip address>:<directory> 3 Make an installation directory. # mkdir /data/install 4 Find out which version is currently installed. # cat /data/stingray/etc/version 5 Extract the contents of the archive, using the C option to expand it into /data/install. # tar jxf <product>.bz2 C /data/install 6 Go to the /data/install directory. # cd /data/install 7 Run the platform installation script. Type./install_platform to get help on available options. #./install_platform U P <platform type> The script completes, then instructs you to reboot. 8 Restart the system. # reboot Restarting the system might take 10 15 minutes. 9 Log on to the appliance again as root. 8
10 Go to the installation directory. # cd /data/install 11 Run the application installation script. #./install_stingray U P <platform type> The script completes, then instructs you to reboot. 12 Restart the system. # reboot If the patch installation fails, do not install it again. Call McAfee support and submit an installation log file. Known issues For known issues in this product release, refer to KnowledgeBase article KB76932. Find product documentation McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the McAfee online KnowledgeBase. Task 1 Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com. 2 Under Self Service, access the type of information you need: To access... User documentation Do this... 1 Click Product Documentation. 2 Select a product, then select a version. 3 Select a product document. KnowledgeBase Click Search the KnowledgeBase for answers to your product questions. Click Browse the KnowledgeBase for articles listed by product and version. 9
Copyright 2013 McAfee, Inc. Do not copy without permission. McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. B00