Patch Assessment Content Update Release Notes for CCS Version: Update

Transcription

1 Patch Assessment Content Update Release Notes for CCS 11.1 Version: Update

2 Patch Assessment Content Update Release Notes for CCS 11.1 Legal Notice Copyright 2015 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This Symantec product may contain third party software for which Symantec is required to provide attribution to the third party ( Third Party Programs ). Some of the Third Party Programs are available under open source or free software licenses. The License Agreement accompanying the Software does not alter any rights or obligations you may have under those open source or free software licenses. Please see the Third Party Legal Notice Appendix to this Documentation or TPIP ReadMe File accompanying this Symantec product for more information on the Third Party Programs. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR and subject to restricted rights as defined in FAR Section "Commercial Computer Software - Restricted Rights" and DFARS , et seq. "Commercial Computer Software and Commercial Computer Software Documentation," as applicable, and any successor regulations, whether delivered by Symantec as on premises or hosted services. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement.

3 Symantec Corporation 350 Ellis Street Mountain View, CA

4 Patch Assessment Content Update (PACU) This document includes the following topics: Prerequisites for PACU What's New in PACU Patch Assessment Content Updates for Windows in Patch Assessment Content Updates for UNIX in Updates in PACU Prerequisites for PACU The following are the prerequisites for installing the Patch Assessment Content Updates: Before you install a Patch Assessment Content Update, you must have the Control Compliance Suite 11.1 or later versions installed on your computer. To install PACU or later by using the LiveUpdate feature, you must apply the Quick Fix A new signing certificate is used for all CCS files that are signed after February 12, The Quick Fix includes the Symantec.CSM.AssemblyVerifier.dll, which contains the updated CCS certificate information necessary to validate the certificate. You can download the Quick Fix from the following location:

5 What's New in PACU Note: If the Quick Fix is not applied, the Automatic Updates Installation job will fail. However, there is no impact on the manual installation of PACU without this Quick Fix. To manually install PACU or later, on CCS 11.1 on Windows 2003 Server successfully, you must deploy a Microsoft hotfix. If the hotfix is not applied, the manual installation fails and the digital certificate validation error message is displayed. You must request for this hotfix via the Hotfix Download Available link at the following location: What's New in PACU PACU contains the following updates: Patch Assessment Content Updates for Windows in See Patch Assessment Content Updates for Windows in on page 5. Patch Assessment Content Updates for UNIX in See Patch Assessment Content Updates for UNIX in on page 6. PACU includes the updates from PACU Patch Assessment Content Updates for Windows in PACU contains checks for updates released by Microsoft in May 2015 on raw-data content. Updates for raw-data content MS Cumulative Security Update for Internet Explorer ( ) MS Vulnerabilities in Microsoft Font Drivers Could Allow Remote Code Execution ( ) MS Vulnerability in Windows Journal Could Allow Remote Code Execution ( ) MS15-046

6 Patch Assessment Content Updates for UNIX in Vulnerabilities in Microsoft Office Could Allow Remote Code Execution ( ) MS Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution ( ) MS Vulnerabilities in.net Framework Could Allow Elevation of Privilege ( ) MS Vulnerability in Silverlight Could Allow Elevation of Privilege ( ) MS Vulnerability in Service Control Manager Could Allow Elevation of Privilege ( ) MS Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege ( ) MS Vulnerability in Windows Kernel Could Allow Security Feature Bypass ( ) MS Vulnerabilities in JScript and VBScript Scripting Engines Could Allow Security Feature Bypass ( ) MS Vulnerability in Microsoft Management Console File Format Could Allow Denial of Service ( ) MS Vulnerability in Schannel Could Allow Information Disclosure ( ) Patch Assessment Content Updates for UNIX in There are a total of 150 updated patches and 541 new patches in dat (template) files for the following platforms: Updates for raw-data content Sun Solaris Linux Ubuntu

7 Updates in PACU HP-UX Updates in PACU The PACU contained the following updates: Patch Assessment Content Updates for Windows in PACU contains checks for updates released by Microsoft in April 2015 on message-based content. Updates for message-based content MS Cumulative Security Update for Internet Explorer ( ) MS Vulnerability in HTTP.sys Could Allow Remote Code Execution ( ) MS Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution ( ) MS Vulnerabilities in Microsoft SharePoint Server Could Allow Elevation of Privilege ( ) MS Vulnerability in Windows Task Scheduler Could Allow Elevation of Privilege ( ) MS Vulnerabilities in Microsoft Windows Could Allow Elevation of Privilege ( ) MS Vulnerability in XML Core Services Could Allow Security Feature Bypass ( ) MS Vulnerability in Active Directory Federation Services Could Allow Information Disclosure ( ) MS Vulnerability in.net Framework Could Allow Information Disclosure ( ) MS Vulnerability in Windows Hyper-V Could Allow Denial of Service ( )

8 8 Patch Assessment Content Updates for UNIX in PACU updates the UNIX operating system and application patches for message-based content. Updates for message-based content in Patch Policy HP-UX Oracle Enterprise Linux (OEL) Red Hat Enterprise Linux (RHEL) Solaris SUSE Comprehensive standard for Windows and UNIX on message-based content PACU contains the comprehensive standard for the patch policy. Table 1-1 Message-based data content patch policy and standard updates for Windows and UNIX File Name ESM_OSPatches_Comprehensive.xml Standard Version OS Patch Policy Version PACU contains the following files: Table 1-2 Name SEForMSPatches_Comprehensive.xml SEForMSPatches_Less.xml LinuxRecommendedPatches.dat HP-UXRecommendedPatches.dat Description Raw-data content standard for Windows Raw-data content standard for Windows Raw-data content updates for Linux platforms Raw-data content updates for HP-UX platforms

9 9 Table 1-2 Name (continued) Description AIXRecommendedPatches.dat SunOSRecommendedPatches.dat ESM_OSPatches_Comprehensive.xml bvmssecure.xml hf7b.xml BestPractice_OS_Patch_Updates.exe Comprehensive_AIXPatchStandard.xml Symantec.CSM. UnixPlatformContent.UnixPatchStandard.dll Version Raw-data content updates for AIX platforms Raw-data content updates for Sun OS platforms Message-based content updates for Windows and UNIX Raw-data content file for Windows data collection Raw-data content file for Windows data collection Patch Policy updates on messagebased content for Windows and UNIX. Contains checks which evaluate on APAR and Packages for AIX OS Custom algorithm used for evaluating package checks in the Comprehensive Patch Standard for AIX.