Symantec Enterprise Security Manager JRE Vulnerability Fix Update Guide

Symantec Enterprise Security Manager JRE Vulnerability Fix Update Guide

2 Symantec Enterprise Security Manager JRE Vulnerability Fix Update Guide The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Legal Notice Copyright 2007 Symantec Corporation. All Rights Reserved. Symantec, the Symantec Logo, LiveUpdate, Symantec Enterprise Security Architecture, Enterprise Security Manager, and NetRecon are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON- INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19 "Commercial Computer Software - Restricted Rights" and DFARS 227.7202, "Rights in Commercial Computer Software or Commercial Computer Software Documentation", as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement. Symantec Corporation 20330 Stevens Creek Blvd. Cupertino, CA 95014 http://www.symantec.com Printed in the United States of America. Third Party Legal Notices This Symantec product may contain third party software for which Symantec is required to provide attribution to the third party ( Third Party Programs ). Some of the Third Party Programs are available under open source or free software licenses. The License Agreement accompanying the Software does not alter any rights or obligations you may have under those open source or free software licenses. Please see the Code of Use

3 Documentation accompanying this Symantec product for more information on the Third Party Programs. Privacy; Data Protection: Symantec may collect and store certain non-personally identifiable information for product administration and analysis. Symantec may disclose the collected information if asked to do so by a law enforcement official as required or permitted by law or in response to a subpoena or other legal process. In order to promote awareness, detection and prevention of Internet security risks, Symantec may share certain information with research organizations and other security software vendors. Symantec may also use statistics derived from the information to track and publish reports on security risk trends. By using the Licensed Software, You acknowledge and agree that Symantec may collect, transmit, store, disclose and analyze such information for these purposes. From time to time, the Licensed Software will collect certain information from the computer on which it is installed, which may include: (a) Information regarding installation of the WebClient Installer including username and password which should not be personally identifiable if You have chosen an alias to protect Your identity. (b) Information collected by the WebClient Profile such as mandatory user/employee information including, name, e-mail address, title, position, physical address and use ID/ employee ID as well as IP address and username. (c) Other information including username, user events and IP addresses which is used for product administration and analysis. All of the above information is collected and stored on the Your side and is not transferred to Symantec. Consult Your company s privacy policy for further information.

4 Technical support Contacting Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product feature and function, installation, and configuration. The Technical Support group also authors content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec technical support offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization A telephone and web-based support that provides rapid response and up-tothe-minute information Upgrade insurance that delivers automatic software upgrade protection Content Updates for virus definitions and security signatures that ensure the highest level of protection Global support that is available 24 hours a day, 7 days a week worldwide. Support is provided in a variety of languages for those customers that are enrolled in the Platinum Support program Advanced features, including Technical Account Management For information about Symantec s Maintenance Programs, you can visit our Web site at the following URL: www.symantec.com/techsupp/ Select your country or language under Global Support. The specific features that are available may vary based on the level of maintenance that was purchased and the specific product that you are using. Customers with a current maintenance agreement may access Technical Support information at the following URL: www.symantec.com/techsupp/ Select your region or language under Global Support. Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to recreate the problem. When contacting the Technical Support group, please have the following information available: Product release level Hardware information

5 Available memory, disk space, NIC information Operating system Licensing and registration Customer Service Version and patch level Network topology Router, gateway, and IP address information Problem description Error messages/log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: www.symantec.com/techsupp/ Select your region or language under Global Support, and then select the Licensing and Registration page. Customer service information is available at the following URL: www.symantec.com/techsupp/ Select your country or language under Global Support. Customer Service is available to assist with the following types of issues: Questions regarding product licensing or serialization Product registration updates such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade insurance and maintenance contracts Information about Symantec Value License Program Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs or manuals Maintenance agreement resources If you want to contact Symantec regarding an existing maintenance agreement, please contact the maintenance agreement administration team for your region as follows:

6 Additional Enterprise services Asia-Pacific and Japan: contractsadmin@symantec.com Europe, Middle-East, and Africa: semea@symantec.com North America and Latin America: supportsolutions@symantec.com Symantec offers a comprehensive set of services that allow you to maximize your investment in Symantec products and to develop your knowledge, xpertise, and global insight, which enable you to manage your business risks proactively. Enterprise services that are available include the following: Symantec Early Warning Solutions Managed Security Services Consulting Services Educational Services These solutions provide early warning of cyber attacks, comprehensive threat analysis, and countermeasures to prevent attacks before they occur. These services remove the burden of managing and monitoring security devices and events, ensuring rapid response to real threats. Symantec Consulting Services provide on-site technical expertise from Symantec and its trusted partners. Symantec Consulting Services offer a variety of prepackaged and customizable options that include assessment, design, implementation, monitoring and management capabilities, each focused on establishing and maintaining the integrity and availability of your IT resources. Educational Services provide a full array of technical training, security education, security certification, and awareness communication programs. To access more information about Enterprise services, please visit our Web site at the following URL: http://www.symantec.com Select your country or language from the site index.

Contents Symantec Enterprise Security Manager JRE Vulnerability Fix Update Guide About the vulnerability... 3 Applying the fix... 4 Applying the fix on Symantec ESM 6.5.x manager/agent/console/utilities and 6.5.3 SP1, 6.5.3 SP2 manager/agent/console... 5 Applying the fix on Symantec Enterprise Reporting Database Link... 5 Applying the fix on Symantec Enterprise Reporting... 6 Verifying the JRE vulnerability fix... 7 Updating the JRE at the default location... 9

2 Contents

Symantec Enterprise Security Manager JRE Vulnerability Fix Update Guide The Symantec Enterprise Security Manager JRE Vulnerability Fix Update Guide provides information on how to apply the Symantec Enterprise Security Manager (ESM) Java Runtime Environment (JRE) vulnerability fix to the ESM components that are susceptible to the JRE vulnerability. About the vulnerability A vulnerability in the JRE with applet caching may allow an untrusted applet that is downloaded from a malicious Web site to make multiple nerwork connections to different machines. This may allow network resources and vulnerabilities, which are not otherwise normally accessible to be accessed or exploited. For information on this vulnerability, see the following URL: http://sunsolve.sun.com/search/document.do?assetkey=1-26-103079-1 This fix is applicable to the following: All Symantec ESM 6.5.x/6.5.3 SP1/6.5.3 SP2 managers, agents, console on Windows Symantec ESM 6.5.x utilities on Windows Symantec Enterprise Reporting Database Link (RDL) 6.1.1, 6.5.3, 6.5.3 SP1, and 6.5.3 SP2 on Windows and Solaris

4 Symantec Enterprise Security Manager JRE Vulnerability Fix Update Guide Downloading the ESM JRE Vulnerability Fix Symantec Enterprise Reporting 6.1.1, 6.5.3, 6.5.3 SP1, and 6.5.3 SP2 on Windows and Solaris UNIX computers running Symantec Enterprise Reporting 6.1.1, 6.5.3, and 6.5.3 SP1 contain a JRE vulnerability that is addressed by JRE 1.3.1_21. However, JRE 1.3.1_21 is supported only on Solaris 8. Windows computers running Symantec Enterprise Reporting 6.1.1, 6.5.3, and 6.5.3 SP1, have the following JRE vulnerabilities: 1.3.1_20 1.4.2_15 Since Sun has declared EOL (End of Life) for JRE 1.3.1_20, this Hotfix does not address the vulnerability in JRE 1.3.1_20. For more information, refer to the Sun s Web site at: http://java.sun.com/j2se/1.3/download.html Note: This fix is not applicable to the ESM agents that are installed using the MSI installer on Windows. Note: If you upgrade to a higher ESM version, you must reapply the JRE vulnerability fix on the new ESM version. This condition applies even if the previous ESM version was patched with the fix. Downloading the ESM JRE Vulnerability Fix Download the following file to update the Symantec ESM components: JRE_Vulnerability_Fix.zip This file is downloaded in your default downloads folder. Note: You cannot deploy this Hotfix via remote upgrade. You must install this Hotfix manually on the vulnerable computers. Applying the fix This section contains information on how to apply the fix on the following: Symantec ESM 6.5.x managers, agents, consoles, and utilities

Symantec Enterprise Security Manager JRE Vulnerability Fix Update Guide Applying the fix 5 Symantec Enterprise Reporting Database Link Symantec Enterprise Reporting Applying the fix on Symantec ESM 6.5.x manager/agent/console/ utilities and 6.5.3 SP1, 6.5.3 SP2 manager/agent/console You can apply the fix on Symantec ESM 6.5.x manager/agent/console/utilities and 6.5.3 SP1, 6.5.3 SP2 manager/agent/console by performing the steps mentioned below. To update the JRE for Symantec ESM 6.5.x, 6.5.3 SP1, or 6.5.3 SP2 components 1 Change to the folder where you extracted the files from JRE_Vulnerability_Fix.zip. 2 Change to the ESM65_JRE_PATCH folder. 3 Double-click Symantec_ESM_JRE_Vulnerability_Fix.exe. 4 On the Important window, click OK. 5 Click Next. 6 Select I accept the terms of the license agreement and click Next. 7 Read the summary information and click Install. 8 Click Finish. Applying the fix on Symantec Enterprise Reporting Database Link You can apply the fix on Symantec Enterprise Reporting Database Link by performing the steps mentioned below. To update the JRE for RDL on Windows 1 Change to the folder where you extracted the files from JRE_Vulnerability_Fix.zip. 2 Change to the RDL_JRE_PATCH\Windows folder. 3 Double-click install.exe. 4 In the Introduction panel, click Next. 5 Select I accept the terms of the license agreement and click Next. 6 Read the Pre-installation summary, and click Install. While the JRE fix gets installed, ESM stops the Symantec Reporting Database Link service and then starts it again.

6 Symantec Enterprise Security Manager JRE Vulnerability Fix Update Guide Applying the fix 7 Click Done. To update the JRE for RDL on Solaris 1 At the command prompt, change to the folder where you extracted files from JRE_Vulnerability_Fix.zip. 2 Change to the RDL_JRE_PATCH\Solaris folder. 3 Type the following command, and press Enter:./install.bin 4 In the Introduction panel, click Next. 5 Select I accept the terms of the license agreement and click Next. 6 Read the Pre-installation summary, and click Install. While the JRE fix gets installed, ESM stops the Reporting Database Link daemon and then starts it again. 7 Click Done. Applying the fix on Symantec Enterprise Reporting You can update the JRE for Symantec Enterprise Reporting on Windows by performing the steps mentioned below. To update the JRE for Symantec Enterprise Reporting on Windows 1 Change to the folder where you extracted the files from JRE_Vulnerability_Fix.zip. 2 Change to the EnterpriseReporting_JRE_PATCH\Win_Solaris_ESM65\Windows folder. 3 Double-click install.exe. 4 In the Introduction panel, click Next. 5 Select I accept the terms of the license agreement and click Next. 6 Read the Installation summary, and click Install. While the JRE fix gets installed, ESM stops the Cognos ReportNet service and then starts it again. 7 Click Done. There are two separate installers of the Hotfix for Symantec Enterprise Reporting on UNIX: Symantec Enterprise Reporting 6.1.1, 6.5.3, and 6.5.3 SP1 Symantec Enterprise Reporting 6.5.3 SP2

Symantec Enterprise Security Manager JRE Vulnerability Fix Update Guide Verifying the JRE vulnerability fix 7 To update the JRE for Symantec Enterprise Reporting on Solaris 1 At the command prompt, change to the folder where you extracted files from JRE_Vulnerability_Fix.zip. There are separate installers of the Hotfix for Symantec Enterprise Reporting 6.1.1, 6.5.3, 6.5.3 SP1, and 6.5.3 SP2. If you are installing the Hotfix for Symantec Enterprise Reporting 6.1.1, 6.5.3, 6.5.3 SP1, then change to the EnterpriseReporting_JRE_PATCH\Win_Solaris_ESM65\Solaris folder. If you are installing the Hotfix for Symantec Enterprise Reporting 6.5.3 SP2, then change to the EnterpriseReporting_JRE_PATCH\Solaris_ESM653SP2\Solaris folder. 2 Type the following command and press Enter:./install.bin 3 In the Introduction panel, click Next. 4 Select I accept the terms of the license agreement and click Next. 5 In the Installation location panel, click Choose... to select the path where Symantec Enterprise Reporting is installed. The default installed location of Symantec Enterprise Reporting is prepopulated. If you specify an incorrect location, ESM generates an error. 6 Read the Installation summary, and click Install. While the JRE fix gets installed, ESM stops the Symantec Enterprise Reporting daemon and then starts it again. Symantec Enterprise Reporting 6.5.3 SP2 launches the configuration dailog box twice during JRE fix installation. Close the dialog box to contiune with the installation. 7 Click Done. Verifying the JRE vulnerability fix The following table lists the JRE versions that must be present on all ESM components after applying the JRE vulnerability fix: Table 3-1 ESM Component JRE version information for ESM components Operating system JRE version JRE installation path Manager/Agent Windows 1.5.0_13 <ESM_install_folder>\ESM \_jvm UNIX N/A N/A

8 Symantec Enterprise Security Manager JRE Vulnerability Fix Update Guide Verifying the JRE vulnerability fix Table 3-1 ESM Component JRE version information for ESM components Operating system JRE version JRE installation path Console Windows 1.5.0_13 <ESM_install_folder>\Sym antec ESM Enterprise Console\_jvm UNIX N/A N/A Utilities Windows 1.5.0_13 <ESM_install_folder>\Sym antec ESM Enterprise Utilities\_jvm UNIX N/A N/A RDL Windows 1.4.2_16 <ESM_install_folder>\ESM Reporting Database Link\ jre UNIX 1.4.2_16 <ESM_install_folder>/ESM Reporting Database Link/ jre Enterprise Reporting 6.1.1, 6.5.3, 6.5.3 SP1 Windows 1.4.2_16 <ESM_install_folder>\Ente rprise_reporting\uninstall\ jre UNIX 1.3.1_21 <ESM_install_folder>/ Enterprise_Reporting/ uninstall/jre Enterprise Reporting 6.5.3 SP2 Windows 1.4.2_16 <ESM_install_folder>\Ente rprise_reporting\bin\ jre\1. 4.2 1.4.2_16 <ESM_install_folder>\Ente rprise_reporting\uninstall\ jre UNIX 1.4.2_16 <ESM_install_folder>/ Enterprise_Reporting/ uninstall/jre To verify the JRE version on the ESM components 1 At the command prompt, change to the directory where JRE is installed. Refer to Table 3-1 for information on the JRE installation path. 2 Change the directory to bin directory and type the following command: java -version (on Windows)

Symantec Enterprise Security Manager JRE Vulnerability Fix Update Guide Updating the JRE at the default location 9./ java -version (on UNIX) 3 Verify the JRE version that is displayed, with the JRE version specified in Table 3-1. Updating the JRE at the default location The following is the default location of JRE on Windows: <windows_install_dir>\program Files\Java If no version of JRE is present at this location, ESM installs the JRE version that ESM is shipped with. However, the JRE vulnerability fix does not update this JRE version since it could be used by other applications. Symantec recommends that you update the JRE that is present at this location to JRE version 1.5.0_13 from the following Sun Web site: http://java.sun.com/javase/downloads/index_jdk5.jsp

10 Symantec Enterprise Security Manager JRE Vulnerability Fix Update Guide Updating the JRE at the default location