Bitdefender Endpoint Security Tools

Transcription

1 Bitdefender Endpoint Security Tools RELEASE NOTES

2 Bitdefender Endpoint Security Tools Release Notes Copyright 2015 Bitdefender Legal Notice All rights reserved. No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without written permission from an authorized representative of Bitdefender. The inclusion of brief quotations in reviews may be possible only with the mention of the quoted source. The content can not be modified in any way. Warning and Disclaimer. This product and its documentation are protected by copyright. The information in this document is provided on an as is basis, without warranty. Although every precaution has been taken in the preparation of this document, the authors will not have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in this work. This book contains links to third-party Websites that are not under the control of Bitdefender, therefore Bitdefender is not responsible for the content of any linked site. If you access a third-party website listed in this document, you will do so at your own risk. Bitdefender provides these links only as a convenience, and the inclusion of the link does not imply that Bitdefender endorses or accepts any responsibility for the content of the third-party site. Trademarks. Trademark names may appear in this book. All registered and unregistered trademarks in this document are the sole property of their respective owners, and are respectfully acknowledged E470D0A1A0A D D D D8E22CF AECE1CE B B A9C B D33DD D19DB762E05AA012A A B0F02C5C09E94769E77FE69C3597FA0E61B6D8F53683D943A0F412 ABD4D9A CA66F7972AD0A3A1544F1C42B37A3AF DA7F6BB26AEEF D2E63847DF4295AE AA74D334A3925ED8AC7ACD28BD0CAADD357CA299 AC3A AAAB E9253C4EA111D7CE97E924A5A64A614569BE1DE2149E31 F17BD4A8D7790A21DCB148BDC10FE0EA41B7A65E E44AE426082

3 Table of Contents 1. Introduction Version History Version Version Version Version Version Version Version Version Version Version Version Version Version Version Version Version Version Version Known Issues Limitations iii

4 1. INTRODUCTION The New GravityZone business solution introduces Bitdefender Endpoint Security Tools, the latest security agent for physical and virtual endpoints. Compared to the existing Bitdefender security agents, this agent brings a series of improvements and new features that takes endpoint security to a new level. This document covers what is new, resolved issues for each Bitdefender Endpoint Security Tools release. The document also includes the known issues and limitations of the product. Under the Known Issues section you can inspect the list of reported yet unresolved issues. This list is updated periodically and we kindly recommend you consult it before submitting any issues to our Support Team. Note Bitdefender Endpoint Security Tools release notes include also the changes related to Microsoft Exchange Servers protection, a feature that may not be available for your Bitdefender GravityZone security pack. Introduction 1

5 2. VERSION HISTORY 2.1. Version Release date: New Features and Improvements Windows & Linux Windows Improved product and signatures update verification mechanisms. Added support for uninstalling the following incompatible security products: F-Secure Client Security F-Secure Client Security Premium F-Secure Client Security Premium McAfee McAfee McAfee ESET Avira 14 Comodo Endpoint Security x These security products can be uninstalled both from the user interface and silently. Integrated the OpenSSL version 1.0.1q in the product s security components. For more information, refer to OpenSSL Security Advisory (English only). Some of the critical and non-critical issues displayed in the Events timeline are now associated with the recommended actions in order to fix them. Made several improvements to the installation process that address the replacement of previous Bitdefender Endpoint Security Tools versions. Version History 2

6 Events generated in the timeline are now displayed only in the context of the logged user. Texts from the Events timeline can now be copied. Exchange Protection Added progress details for Exchange on-demand scans in the Bitdefender Endpoint Security Tools main window. Added several improvements to the Exchange on-demand scan process and error messages. Attachment filtering by filename is now case insensitive. Note During this product update, the Microsoft Exchange Transport service will be stopped. Windows In some situations, HP machines with specific hardware configuration were starting Windows OS in recovery mode. The issue is now fixed. In some situations, Bitdefender Endpoint Security Tools Relay was unable to update the endpoints connected to it. The issue is now fixed. The Firewall module was malfunctioning on certain Windows 10 machines, when it was added to Bitdefender Endpoint Security Tools instances with Content Control enabled. Data Protection policy rules were not applying on HTTPS pages when the browser toolbar was disabled. The issue is now fixed. Excluding encrypted USB sticks from Device Control was malfunctioning. The issue is now fixed. Firewall rules were incorrectly displayed in the Bitdefender Endpoint Security Tools Power User interface. The issue is now fixed. In some situations, scans that finished immediately were displayed with 0% scan progress. The issue is now fixed. Version History 3

7 2.2. Version Release date: Linux In some situations, endpoints were not complying with settings received from Control Center. The issue is now fixed. File exclusions for on-demand scanning were not working correctly. The issue is now fixed Version Release date: Addressed a vulnerability discovered by Andre Derek Protas of CyberPoint SRT through responsible disclosure. The vulnerability was present on Bitdefender Endpoint Security Tools only if the relay module was installed Version Release date: New Features and Improvements Windows Improved the product stability in endurance tests. Improved the performance of the filters from local console. Reorganized the scan log summary for a better user experience. The endpoint notifications pop-ups contain also the name of the product. Version History 4

8 Windows Linux The security agent reconfiguration failed when an uninstall password was set. The issue is now fixed. On some Windows XP and Windows 2003 operating systems, the endpoint failed to communicate with Control Center. The issue is now fixed. The update failed when a proxy was configured both in Control Center and in the browser on the endpoint. The issue is now fixed. Traffic scan exclusions for websites with self-signed certificates were not applying and the websites were displayed as unsafe. The issue is now fixed. In some situations, the security agent deployment status in Control Center remained stuck to In Progress. The issue is now fixed. In some situations, the full system scan log contained some fictive disk drives. The issue is now fixed. The missed scheduled scans were running as soon as possible only when the day was selected in the scheduler. The issue is now fixed. In some situations, the firewall rules descriptions were missing from the Power User menu. The issue is now fixed. In some situations, the update events were incorrectly added to other types of events in the main window. The issue is now fixed. Fixed several untranslated texts. Fixed an issue where the favorite scan text was overlapping in some localizations. Linux physical machines from Active Directory appeared in Custom Groups. The issue is now fixed. The missed scheduled scans were running as soon as possible only when the day was selected in the scheduler. The issue is now fixed. Exchange Protection Version History 5

9 Fixed an issue where the security agent was ignoring addresses written with wildcards, on these filters: connection blacklist, antispam whitelist, and content and attachment filtering exclusions. The issue occurred only when the lists contained both plain addresses and addresses patterns Version Release date: In some specific situations, the product downloaded a higher amount of signatures than necessary during update. The issue is now fixed Version Release date: Important During this product update, the Microsoft Exchange Transport service will be stopped. New Features and Improvements Windows Added support for Windows Multipoint Server 2011 and Bitdefender Endpoint Security Tools is now compatible with Deep Freeze. For more information refer to this KB article. Added support for uninstalling the following incompatible security products: Kaspersky Antivirus 2015 Kaspersky Internet Security 2015 Note The products can be uninstalled only using the user interface. Improved the signature updating mechanism. Version History 6

10 Linux Improved endpoint resource consumption during update operations. Optimized the disk space usage on relays by downloading installation kits only for the operating systems discovered in the network. Added support to automatically move endpoints to a specified folder under Custom Groups in the Network page of Control Center, when Bitdefender Endpoint Security Tools installation finishes. Integrated the Firewall module with Photon Technology, which temporarily allows trusted-installer applications to run when they are detected. Running scheduled scans now stop if the corresponding task was deleted from the management console. Added information about the logged in user to event logs related to malware detection, antiphishing, behavioral scan, blocked applications, blocked websites, data protection and firewall. This information will be visible in several reports from Control Center. Bitdefender Endpoint Security Tools now sends the status information to Control Center for each operation performed in the background during deployment. The endpoint is now able to send information about missed scheduled on-demand scan tasks to Control Center. The on-demand scan summary log now contains information about items with no action applied. Added support to automatically move endpoints to a specified folder under Custom Groups in the Network page of Control Center, when Bitdefender Endpoint Security Tools installation finishes. Bitdefender Endpoint Security Tools now sends the status information to Control Center for each operation performed in the background during deployment. The on-demand scan summary log now contains information about items with no action applied. Improved the detection mechanism of physical and virtual machines. Version History 7

11 Added information about the logged in user to event logs related to malware detection. This information will be visible in several reports from Control Center. The endpoint is now able to send information about missed scheduled on-demand scan tasks to Control Center. The update process has been optimized. Exchange Protection Included Domain IP Check filter to help administrators protect their domains from spoofing. Improved the Attachment Filtering module by adding file detection inside archives. Connection blacklist, antispam whitelist, and content and attachment filtering exclusions now support addresses containing wildcards. This will allow, for example, an administrator to exclude an entire domain from filtering. Added support for actions and reports on unscannable files. The files can now be deleted files, replaced with a notice, or sent to quarantine. Added support for displaying the status progress of running on-demand Exchange scan tasks in Control Center. Improved the on-demand scan errors messages. Windows In some situations, when using centralized scanning, the antimalware modules crashed after a signature update. The issue is now fixed. In some situations, the uninstall task issued from Control Center failed. The issue is now fixed. The message related to Cloud Services unavailability was not refreshed after the connectivity has been reestablished. The issue is now fixed. Statistical update information was not sent anymore from Bitdefender Endpoint Security Tools to buddy.bitdefender.com. The issue is now fixed. Version History 8

12 Linux Fixed some translated texts. Product installation was unsuccessful if the setup folder name contained special characters. The issue is now fixed. BitDefender Logger Daemon was restarting after every signature update. The issue is now fixed. Exchange Protection In a particular situation, after installing Bitdefender Endpoint Security Tools with Exchange Protection role in a custom folder, Microsoft Exchange Transport service remained stopped if Bitdefender Transport Agent could not start due to insufficient permissions. The issue is now fixed Version Release date: On some specific hardware, the rootkit driver was conflicting with a third party iscsi driver, leading to system crashes. In the situation that the system is unable to boot, thus to update Bitdefender Endpoint Security Tools, you need to run this patch. If the update required a reboot and the reboot scheduler was set to a specific day and hour of the week, only the hour was taken into account. The issue is now fixed Version Release date: Note This release includes improvements and fixes related only to the file system protection. New Features and Improvements Added support for uninstalling the following incompatible security products with user interface and also silent: Version History 9

13 Bitdefender Box ESET NOD32 Antivirus McAfee Endpoint Security Platform McAfee Endpoint Security Threat Prevention McAfee Endpoint Security Web Control McAfee SaaS Security Center Communication version Patch 3 McAfee TPSConnector Improved the cleaning process during Bitdefender Endpoint Security Tools installation. Added support for Windows 10 TH2. Endpoints were rebooting after each Sophos protection module removal. The issue is now fixed. In some situations, McAffee Agent and Panda Free Antivirus could not be uninstalled. The issue is now fixed. Note These products can be uninstalled only from the user interface. Fixed an installation issue on ATM machines running Windows 7 Professional 32-bit. Fixed an issue at remote deployment through relay, which was returning error code "1385". When upgrading from Endpoint Security to Bitdefender Endpoint Security Tools, the user interface did not preserve language settings. The issue is now fixed. In some situations, the machines from Active Directory were listed multiple times in Control Center. The issue is now fixed. In some situations, when the user logged in Windows, the Bitdefender icon did not show in Windows Notifications Area and all protection modules were disabled. The issue is now fixed. Version History 10

14 In some situations, Bitdefender Endpoint Security Tools deployment was unsuccessful when installing the Firewall module. The issue is now fixed. Firewall rules using the environment variable %localappdata% were not applying on endpoints. The issue is now fixed. Fixed an issue that was preventing users from creating or updating certain security certificates. Bitdefender Endpoint Security Tools was blocking an ActiveX control that connects to CCTV cameras, thus preventing video streaming. The issue is now fixed. Content Control was preventing VMEET application from streaming video content. The issue is now fixed. Webex was unavailable when Scan SSL option was enabled in Content Control. The issue is now fixed. Device Control settings were not persistent after a computer reboot. The issue is now fixed. Device Control was unable to block HTC devices running Android The issue is now fixed Version Release date: Windows In some corner cases, a communication error occurred with the following message: The Antimalware on-access scanning is unavailable. Connection to scan server could not be established. The issue is now fixed Version Release date: Version History 11

15 New Features and Improvements Windows & Linux Improved the product stability and performance. The communication between Bitdefender Endpoint Security Tools and Cloud Services is now secured by SSL. Port 7076 will be opened on the relay endpoint. Improved the endpoint type detection mechanism. Windows In some situations, the following message was displayed: There is no connection with the security host service. Please restart your system. and all modules of the security agent were turned off, while in Control Center, only the antimalware module was reported as disabled. The issue is now fixed. In some corner cases, a BSOD occurred after installing Bitdefender Endpoint Security Tools version The issue is now fixed. In some situations, the security agent used an abnormal large amount of RAM memory. The issue is now fixed. In some situations, Bitdefender Endpoint Security Tools version appeared outdated even though it was the latest version available. The issue is now fixed. The Firewall module could not install on endpoint after system upgrade to Windows 10. The issue is now fixed. Microsoft Surface Pro tablets were improperly detected as virtual machines. The issue is now fixed. After upgrade to Windows 10, the Firewall module was reported as disabled in Windows Action Center. The issue is now fixed. Fixed some graphical user interface issues related to missing buttons and to the console display on screen. Version History 12

16 Linux During antimalware scanning, the endpoint became unresponsive if encrypted folders were detected. The issue is now fixed. Exchange Protection The EWS URL configured by the administrator was not taken into account if Exchange Protection managed to obtain an EWS URL via autodiscovery. This fact prevented the Exchange on-demand scan from running in particular EWS URL configurations. The issue is now fixed. In some cases, spam messages detected by the RBL filter were given a SCL score of -1. The issue is now fixed. Exchange scan tasks run by the administrator would either not show in the local Bitdefender Endpoint Security Tools interface, or would disappear once the interface was closed. The issue is now fixed Version Note This version is for Windows operating systems. New Features and Improvements Reduced the amount of cloud services outgoing traffic. A BSOD occurred on Windows XP and Windows 2003 machines from Active Directory domains that were running some scripts at startup from Distributed File System locations. This issue is now fixed Version New Features and Improvements Windows Added support for Windows 10. Version History 13

17 Improved the product stability regarding the graphical user interface. Integrated the OpenSSL version 1.0.1p in the product s security components. For more information, refer to OpenSSL Security Advisory [9 Jul 2015] (English only). Bitdefender Endpoint Security Tools Relay now automatically adds the necessary rules to Windows Firewall during installation on server operating systems. Added support for removing the following incompatible security products: Trusteer Rapport System Center Endpoint Protection * Symantec.Cloud - Endpoint Protection NIS * Sophos * Vipre Business Agent * Eset File Server *Support provided also for silent uninstall. Minor improvements to the graphical user interface. Windows Microsoft Excel 2007 was crashing during file save when Bitdefender Endpoint Security Tools was used. This issue is now fixed. Sysprep is not working when BEST is installed. To troubleshoot this issue, refer to this KB article. For some DNS servers, the queries from Bitdefender Endpoint Security Tools to Cloud Services were unsuccessful. This issue is now fixed. In some situations, endpoints protected by Bitdefender Endpoint Security Tools could not join an Active Directory domain. This issue is now fixed. Bitdefender Endpoint Security Tools installation was crashing on endpoints with high CPU usage. This issue is now fixed. Version History 14

18 Linux Fixed an issue occurred when a scan task was postponed from the user interface. Support Tool was not collecting all necessary files. This issue is now fixed. Technical Support information was not updating correctly when it was changed in the policy. This issue is now fixed. Air Control 2 was blocked by the Content Control module. This issue is now fixed. The last scan log of successive scans from the contextual menu could not be viewed from the user interface. This issue is now fixed. Fixed some misspelled texts. On-demand scan tasks could not scan paths containing non Latin characters. This issue is now fixed. For some DNS servers, the queries from Bitdefender Endpoint Security Tools to Cloud Services were unsuccessful. This issue is now fixed. Exchange Protection In some situations, an XML error occurred when opening an Exchange scan report from the Information window. This issue is now fixed. On-demand scan log showed ignored infections at Resolved Items. This Issue is now fixed. When trying to restore s from quarantine and Microsoft Exchange Autodiscovery was using a redirected EWS URL, the task was failing with the status message Generic error. This issues is now fixed Version Note This version is for Linux operating systems. The deployment on SUSE 11 SP3 distribution was failing due to one installation file download error. This issue is now fixed. Version History 15

19 2.14. Version New Features and Improvements Windows Increased the waiting time for pending reboot during the security agent installation at ten minutes. Improved memory usage. Windows When repairing the Bitdefender Endpoint Security Tools files, the Logs folder for scan tasks was not created in the product folder, blocking the on-demand scan tasks to run. This issue is now fixed. In some situations, after upgrading from Endpoint Security to Bitdefender Endpoint Security Tools, Control Center still displayed the old product in the computer details. This issue is now fixed. In some situations, the security agent deployment on Windows 8.1 systems has failed. This issue is now fixed. In some situations, Bitdefender Endpoint Security Tools files could not be repaired if the Content Control module was installed. Fixed some issues at the built-in firewall rules, which occurred when accessing an Active Directory domain or when connecting through Remote Desktop Connection. In some situations, when repairing the product files and a system reboot was required, the system entered in a reboot loop. This issue is now fixed. NTLM and Kerberos based proxies were not supported. This issue is now fixed. Fixed several minor issues. Version History 16

20 Linux NTLM and Kerberos based proxies were not supported. This issue is now fixed. In some situations, the Update Client task did not work. This issue is now fixed Version Note This version is for Windows operating systems. When upgrading the endpoint clients to Bitdefender Endpoint Security Tools, the agent did not start after the system reboot. This issue is now fixed. In some situations, after upgrading from Endpoint Security to Bitdefender Endpoint Security Tools, some protected endpoints were not displayed in Control Center anymore. This issue is now fixed. Exchange Protection Unauthenticated s were considered authenticated if they were routed through multiple transport servers. This issue is now fixed. s with password-protected archives that were not scanned, were reported as infected but with no action taken on them. This issue is now fixed Version Fixed some issues at the component that ensures the communication with Control Center. Version History 17

21 2.17. Version Bitdefender Endpoint Security Tools was not reporting correctly its update status to Control Center when an update was available. This issue is now fixed. A blocked process occurred in certain situations was causing the endpoint to run slow. This issue is now fixed. On Windows endpoints, the upgrade from Endpoint Security did not resume after reboot if the check box Automatically reboot (if needed) was not previously selected in the Upgrade Client(s) window. This issue is now fixed. In some situations, the security agent reconfiguration failed on Windows endpoints. This issue is now fixed. The graphical user interface of the Windows version contained some truncated labels and some missing translations. These issues are now fixed Version New Features and Improvements Deployment Extended protection for physical endpoints to cover also desktop and server Linux distributions. One installation package, which can be deployed in any environment: physical, virtual or in-the-cloud. Ability to uninstall other antimalware products regardless of the endpoint s environment (physical or virtual). Scanning Technologies New and flexible scanning technologies for Windows and Linux endpoints with various hardware configurations: Local Scan, where the antimalware scanning is performed locally on the endpoint. This option is suitable for powerful endpoints that are also able to store the scanning engines and the malware signatures. Version History 18

22 Central Scan, where the antimalware scanning is performed by one or multiple Security Servers, using load balancing. This option is suitable for virtualized environments and for physical desktop endpoints with low hardware performance. Note Security Server is a dedicated virtual machine that acts as a scan server. The Security Server installs on a host in a virtualized environment. For more information, refer to GravityZone Installation Guide. Hybrid Scan, where the antimalware scanning is performed mainly in-the-cloud and it is enhanced by local scanning. This option is suitable for physical endpoints with low to medium performance and resources. Bitdefender Endpoint Security Tools ensures the same level of protection regardless of the selected scanning mode. Higher availability of the remote scanning engines by introducing the dual engines scanning. Thus, if the first engine is unavailable, the fallback engine will be used. Two options are available: Central Scan with fallback on Hybrid Scan. Central Scan with fallback on Local Scan. Note Resource consumption and network utilization will be based on used engines. With the ability to detect the endpoint s configuration and environment, Bitdefender Endpoint Security Tools automatically self-configures and adapts the scanning technology accordingly. Note This action is performed during product installation and can be overridden by the administrator. New Modules and Roles Device Control protection module, providing the ability to control and monitor the access to various devices that may connect to the endpoints. The module Version History 19

23 recognizes a vast series of devices: Bluetooth devices, CDROM drives, floppy disk drives, IEEE devices, IEEE 1394 devices, imaging devices, internal and external storage, LPT/COM ports, modems, network adapters, printers, SCSI RAID, tape drives and Windows portable devices. Power User module, enabling administration rights at endpoint level, allowing the endpoint user to access and modify policy settings via a local console, through the BEST interface. New features for protecting VDIs: Behavioral scan: keeps applications temporarily in a sandbox to identify malicious actions. Photon (Application Reputation): monitors all running software and decides if applications and their components are safe or not. Firewall: Fully featured two-way firewall with Intrusion Detection System. Content Control: Multiple thread filtering of web content to identify potential online threats. Extended Relay role for virtual machines as well. The Relay role converts the agent to an update, deployment and communication server for all machines in a remote location. Note Bitdefender Endpoint Security Tools with Relay role installs only on Windows machines. You can use Bitdefender Endpoint Security Tools with Relay role to deploy the security agents on any supported operating system. Exchange Protection role, providing antimalware, antispam, antiphishing, attachment and content filtering seamlessly integrated with the Microsoft Exchange Server, to ensure a secure messaging and collaboration environment and increase productivity. Exchange Protection uses the same antimalware scanning technologies as the file system Antimalware module. Exchange Protection supports and installs on the following Microsoft Exchange Server versions and roles: Exchange Server 2013 with Edge Transport or Mailbox role Exchange Server 2010 with Edge Transport, Hub Transport or Mailbox role Version History 20

24 Exchange Server 2007 with Edge Transport, Hub Transport or Mailbox role Note The solution is compatible with Microsoft Exchange Database Availability Groups (DAGs). User Interface Bitdefender Endpoint Security Tools comes with a series of user interface improvements, such as: A lighter and more comfortable color scheme for day to day use, which gives emphasis to content. Loose design for a friendly touch screen experience. A structure focused on readability, maximizing the available space for displaying the information. An enhanced user interaction, offering the following options: 1. Notifications area, informing the user about unresolved issues and linking to the details screen. 2. Events timeline, displaying the events related to endpoint s protection. 3. Expand and Collapse arrows, displaying or hiding the events belonging to the same category. 4. Modules button, linking to a new screen where the user can view the status of installed modules and manage the file system Quarantine. 5. Filters menu, allowing the user to refine the list of events displayed in the timeline. 6. Actions menu, allowing the user to define, run and save scanning tasks and to check for updates. Version History 21

25 Bitdefender Endpoint Security Tools main window Version History 22

26 3. KNOWN ISSUES The upgrade from Endpoint Security requires system reboot on Windows endpoints if Advanced Threat Control and the rootkit driver fail to unload. The upgrade from Endpoint Security requires system reboot on Windows XP endpoints if the Firewall module was installed. Removing the Firewall module on Windows XP endpoints requests a system reboot. The Advanced Threat Control module is incompatible with Citrix EdgeSight. Exchange Protection When two Exchange scan tasks are scanning simultaneously the same mailbox, some s are not scanned. It is recommended to avoid running more than one Exchange scan at a time. Product updates might stop running Exchange scan tasks, without sending the status change to Control Center. The antimalware footer is not visible in digitally signed s sent over Microsoft Exchange (MAPI) protocol. When adding UTF-8 footer to an HTML or plain text MIME with ISO-2022-JP encoding, the converted may include slightly changed characters. However, this should not affect the overall readability and understanding of the text. Known Issues 23

27 4. LIMITATIONS Exchange Protection Exchange on-demand scanning does not work when Powershell v1.0 is installed. In such cases, you must update Powershell to v2.0. Meeting or task request s cannot be modified. Limitations 24