ePolicy Orchestrator update fixes multiple Oracle Java vulnerabilities - July 2016

ePO is vulnerable to the following CVEs reported in Oracle's July 2016 Java SE update.

Collectively, these vulnerabilities affect integrity and availability of the server.

AFFECTED SOFTWARE
ePO 5.1.3 and earlier
ePO 5.3.2 and earlier

REMEDIATED/PATCHED VERSIONS

Oracle Java 7.0 officially reached End of Life (EOL) status in April of 2015. The Java version currently supported in ePO 5.1.x and 5.3.x has been upgraded to Java 8.0. This issue is remediated with ePO 5.x Hotfix 1151890. These fixes will be included in the next ePO patch when scheduled.

ePO 5.1.3 + Hotfix 1151890 (EPO5xHF1151890.zip)
ePO 5.3.1 + Hotfix 1151890 (EPO5xHF1151890.zip)
ePO 5.3.2 + Hotfix 1151890 (EPO5xHF1151890.zip)

McAfee recommends that all customers verify that they have applied the latest updates. Impacted users should install the relevant patches or hotfixes. For full instructions and information, see McAfee Knowledge Base article SB10166.

ePolicy Orchestrator update fixes multiple Oracle Java vulnerabilities - May 2016

ePO is vulnerable to multiple CVEs reported in Oracle's April 2016 Java SE update. Collectively, these vulnerabilities affect confidentiality, integrity, and availability of the server.

McAfee Agent 5.0.2 Hotfix 1110392 is now available

Multiple McAfee endpoint products include a private mechanism to access settings and files protected by self-protection rules. This mechanism is not sufficiently secure and may be misused to access registry keys and files that should be protected from tampering.
When VirusScan Enterprise (VSE) is present on the device, processes that attempt to use this private mechanism are scanned upon access, but if not detected as malware could gain access to McAfee products protected resources.
This trusted access bypass vulnerability allows access to resources normally protected by the vulnerable products.
Though McAfee Agent 5.0.x, ship the vulnerable technology, it has already transitioned to a new self-protection mechanism that doesn’t rely on the vulnerable technology. However it requires an update to fully disable the vulnerable technology.
This release includes:

• Fixes as described in PD26386 - McAfee Agent 5.0.2 Hotfix 1110392 Release Notes
• Hotfix 1110392 is rated mandatory due to a security fix as described in the release notes.

To download McAfee Agent 5.0.2 Hotfix 1110392 (MA502HF1110392WIN.zip), go to the product downloads site Refer to Security Bulletin SB10151 for additional details

VirusScan Enterprise 8.8 Patch 7 Now Available

VirusScan Enterprise 8.8 Patch 7 is now available. 

This update has been scored 'mandatory' by Intel Security. This score is based on the Security Vulnerability which has been previously identified and since patch in this release.

Multiple McAfee endpoint products include a private mechanism to access settings and files protected by self-protection rules. This mechanism is not sufficiently secure and may be misused to access registry keys and files that should be protected from tampering.

This release includes new features, fixes, and enhancements including:

• A vulnerability is addressed in this release. See SB10151 for details.
• This release is rated “Mandatory”.
• See release notes for MA 5.x version restrictions. 
• TIE customers are advised to use 1.0.140 or later.
• Adds Windows 10 TH2 Support, including the Secure/UEFI feature.
• Adds 5800 engine (for new installations)
• Please review your Windows service dependencies practices. See KB85374.

For a full list of changes, see the Release Notes in PD26382

For a list of known issues, see KB70393

ePolicy Orchestrator update fixes multiple Oracle Java vulnerabilities

ePO is vulnerable to the multiple CVEs reported in Oracle's January 2016 Java SE update. Collectively, these vulnerabilities affect confidentiality, integrity, and availability of the server.

AFFECTED SOFTWARE

• ePO 5.1.3 and earlier
• ePO 5.3.1 and earlier

REMEDIATED/PATCHED VERSIONS
The vulnerability is remediated in these versions:

• ePO 5.1.3 + Hotfix 1117371 (EPO5xHF1117371.zip)
• ePO 5.3.1 + Hotfix 1117371 (EPO5xHF1117371.zip) 

McAfee recommends that all customers verify that they have applied the latest updates. Impacted users should install the relevant patches or hotfixes. For full instructions and information, see McAfee Knowledge Base article SB10148.

McAfee ePolicy Orchestrator Vulnerability patched

ePolicy Orchestrator (ePO) is packaged with Apache Commons Collections library version 3.2.1 (commons-collections-3.2.1.jar) which is vulnerable to insecure deserialization of data, which may result in arbitrary code execution.

CERT/CC Vulnerability Note VU#576313
The Apache Commons Collections (ACC) library is vulnerable to insecure deserialization of data, which may result in arbitrary code execution. Java applications that either directly use ACC, or contain ACC in their classpath, may be vulnerable to arbitrary code execution.

Remediation

This issue is remediated with ePO 5.x Hotfix 1106041. These fixes will be included in the next ePO patch release.

• Users of ePO 4.6.x are recommended to upgrade to ePO 5.1.3 or 5.3.1 and then apply hotfix EPO5xHF1106041.zip.
• Users of ePO 5.0.x and 5.1.x should upgrade to ePO 5.1.3 or 5.3.1 and then apply hotfix EPO5xHF1106041.zip.
• Users of ePO 5.3.0 should upgrade to ePO 5.3.1 and then apply hotfix EPO5xHF1106041.zip.

Product	Type	File Name	Release Date
ePO 5.3.1	Hotfix	ePO5xHF1106041.zip	December 30, 2015
ePO 5.1.4	Patch	TBD	Q2 2016
ePO 5.1.3	Hotfix	ePO5xHF1106041.zip	December 30, 2015

Recommendation

Intel Security recommends that all customers verify that they have applied the latest updates. Impacted users should install the relevant patches or hotfixes. For full instructions and information, see the Knowledge Base article SB10144

See the ePolicy Orchestrator 5.x Hotfix 1106041 Release Notes for further details at:

McAfee ePO 5.0.1 and later — Update on POODLE (CVE-2014-3566) OpenSSL Vulnerability

McAfee has determined that customers who upgraded to ePO 5.0.1 and later FROM ePO 4.x version may be vulnerable to the POODLE OpenSSL 3.0 vulnerability (CVE-2014-3566) due to a Java security setting migration issue. SSL protocol 3.0, as used in Tomcat 5.5.x and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain clear text data via a padding-Oracle attack, such as the POODLE issue. The security configuration for ePO 5.0.0 and later disables the SSLv3 protocol by default for clean installations of ePO. However, ePO 5.0.1 and later versions may be vulnerable if they have been upgraded from a previous ePO 4.x version. For more information on resolution please visit the ePolicy Orchestrator Sustaining Engineering Statement (SSC1410161) provided by McAfee