Blog Posts

Data Exchange Layer 4.0 Now Available

6/12/2017

DXL 4.0 is now available. This release includes new features, fixes, and enhancements including:
•Integration with Cisco pxGrid
•Multi Geo support for single ePO instances (MAR Trace feature)
•Multi Geo support for multi ePO instances (MAR Trace feature)
•Cloud to on premise messaging (McAfee Investigator feature)
•Tech Preview of Containerized OpenDXL broker available to all via Docker Hub
•Tech Preview of Containerized OpenDXL broker developer environment available to all via Docker Hub
•OpenDXL console
NOTE: The DXL 4.0 Client will follow this release shortly and will ship with the other McAfee client side technologies that support Windows RS3. The DXL 4.0 broker is backwardly compatible with all existing supported DXL Client versions.
To download DXL 4.0, go to the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.
For a full list of changes, see the Release Notes in PD27304: https://kc.mcafee.com/corporate/index?page=content&id=PD27304.

Application Control and Change Control 7.0.1 HF6 is now available

6/12/2017

Application Control and Change Control 7.0.1 HF6 is now available.
This release includes new features, fixes, and enhancements including:
Wildcard feature
The wildcard feature has been added to skip list rules to bypass solidification. With this feature, you can skip folders and directories that you do not want to include in the solidification process such as temporary folders. (More info see Release notes)
Performance improvement
The wildcard feature improves performance by speeding the solidification process. Instead of adding files with unso state (not solidified), you can choose the folder where these files are created and add it to the skip list. Thus, this folder is not included as part of the inventory. This feature also improves customer experience when installing the latest Windows cumulative updates.
To download Application Control and Change Control 7.0.1 HF6, go to the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.
For a full list of changes, see the Release Notes in PD27312.

Threat Intelligence Exchange 2.1 Hotfix 3 Now Available

6/12/2017

Threat Intelligence Exchange (TIE) 2.1 Hotfix 3 is now available. This release includes new features, fixes, and enhancements including:

When Sandboxing is enabled, files that do not match submission criteria are removed from the TIE Server appliance. (1212584)
After files are submitted from the TIE Server to McAfee Cloud Threat Detection for analysis, they are promptly deleted from the TIE Server. (1213470)

To download TIE 2.1 Hotfix 3, go to the Product Downloads site at:
http://www.mcafee.com/us/downloads/downloads.aspx.

For a full list of changes, see the Release Notes in PD27319:
https://kc.mcafee.com/corporate/index?page=content&id=PD27319.

McAfee Active Response (MAR) 2.1.0.270 Bundle Hotfix Now Available

6/12/2017

McAfee Active Response Bundle Hotfix 2.1.0.270 is now available.
This hotfix includes the following fixes:

• An Active Response process registry handle leak was detected and fixed.
• The results from Active Response property Enabled Plugins now matches the query results from Enabled Plugins on McAfee ePO server’s Queries & Reports | Query Builder | Active Response System, and no longer returns an error.

• The File Hashing Status property now appears as an option on McAfee ePO server’s Queries & Reports | Query Builder | Active Response System.
• A McAfee ePO user with basic McAfee Active Response permissions (non-administrator privilege), can now view McAfee Active Response reports on the McAfee ePO server.
• Trace database was improved for handling possible local database corruption.

• Endpoints without Active Response installed, no longer download packages, update rules, or show failures.
You can download McAfee Active Response Hotfix 2.1.0.270 using the ePO Software Manager, or from the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx
For more information, see the Release Notes in PD27297:
https://kc.mcafee.com/corporate/index?page=content&id=PD27297

McAfee ePO Performance Optimizer 2.2.0 Now Available

6/12/2017

McAfee ePO Performance Optimizer 2.2.0 is now available.

McAfee® ePO Performance Optimizer is a product that makes available performance metrics and tuning recommendations about the ePO environment. The product is available at no charge to ePO customers.

Performance Optimizer runs as an ePO extension and collects metrics about the performance of the ePO database, application server, and ePO configuration. The performance metrics can be used to notify administrators using either text message or email.
Summary of new features and enhancements in 2.2.0:
See the release notes and product guide for details on all areas.
• 7 new assessments
• 3 new dashboard queries
• 6 new sample automatic responses
• 4 new event types for the automatic responses
• 3 bug fixes
Download and Documentation
You can download Perfomance Optimizer through the ePO Software Manager or the McAfee Porduct downloads site: http://www.mcafee.com/us/downloads/downloads.aspx.

• PD27293 - Performance Optimizer 2.2.0 Release Notes
• PD27292 - Performance Optimizer 2.2.0 Installation Guide
• PD27291 - Performance Optimizer 2.2.0 Product Guide
• KB87291 - Performance Optimizer Known Issues
For a full listing of Knowledge Base articles, see the ServicePortal Knowledge Center

Network DLP 9.3.4 Hotfix Resolves Vulnerabilities

6/12/2017

Three vulnerabilities in Network DLP 9.3.4 have been discovered and resolved.

AFFECTED SOFTWARE

Network DLP 9.3.4.1.5 and earlier

REMEDIATED/PATCHED VERSIONS
The vulnerabilities are remediated in these versions:

Network DLP 9.3.4.1.5 plus hotfix 1201697_47868

IMPACT

CVE-2017-3933 (CVSS: 3.4; Severity: Medium) Embedding Script (XSS) in HTTP headers in McAfee Data Loss Prevention 9.3.x now does not allow remote authenticated users to view confidential information through a cross site request forgery attack.
CVE-2017-3934 (CVSS: 4.7; Severity: Medium) Missing HTTP Strict Transport Security state information in the server in McAfee Data Loss Prevention 9.3.x now does not allow man-in-the-middle attackers to expose confidential data through read files on the webserver.
CVE-2017-3935 (CVSS: 2.6; Severity: Low) McAfee Data Loss Prevention is no longer vulnerable to MIME type sniffing. MIME type sniffing allows older versions of Internet Explorer to perform MIME-sniffing on the response body. This potentially caused the response body to be interpreted and displayed as a content type other than the intended content type.

RECOMMENDATION
McAfee recommends that all customers verify that they have applied the latest updates. Impacted users should install the relevant patches or hotfixes. For full instructions and information, see Knowledge Base article SB10198, McAfee Security Bulletin - Network Data Loss Prevention update fixes eleven vulnerabilities (CVE-2017-3933, CVE-2017-3934, CVE-2017-3935, CVE-2017-3968, CVE-2017-4011, CVE-2017-4012, CVE-2017-4013, CVE-2017-4014, CVE-2017-4015, CVE-2017-4016, and CVE-2017-4017) (https://kc.mcafee.com/corporate/index?page=content&id=SB10198)

Endpoint Security For Linux Threat Prevention 10.2.2 is Now Available

6/12/2017

Endpoint Security For Linux Threat Prevention 10.2.2 is now available. This release includes new features, fixes, and enhancements including:
Here are the new features :
* Kernel module support for Red Hat Enterprise Linux 7.x and Cent OS 7.x distributions.
* Support for additional operating systems like Fedora 25 and 26. Debian 9 (Only on-demand scanning is supported for Debian 9. On-access scanning is not supported for Debian 9).
* Now you can use the command line to display the list of files
that are being scanned. For more information about using this feature, see McAfee KnowledgeBase article KB89711.
* Systems compliance status : You can now verify the on-access scan services and the kernel hooks status compliance of your systems. For standalone systems, you can verify the status
using the command line, and for managed systems, you can view the status from McAfee ePO. For more information on this, please refer the McAfee KnowledgeBase article KB89803.
Here are the fixes :
* The server non-responsive state issue is no longer experience.
* After the update tasks, the product no longer causes any system hang issue.
* The Autofs mounts are unmounted successfully according to the
defined time-out period.
* The engine errors are now self explanatory in product log.
* On managed systems, the DAT update task no longer remains in
Initiated state when the DAT is not available in the current branch.
* The isectp process now checks the disk space at the appropriate path, and starts successfully.
* The McAfee Endpoint Security for Linux Threat Prevention processes no longer become unresponsive during the product update.
To download Endpoint Security For Linux Threat Prevention 10.2.2 (ISecTP-10.2.2-1098-Release-standalone.tar.gz), go to the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.
For a full list of changes, see the Release Notes in [PD27257]: https://kc.mcafee.com/corporate/index?page=content&id=PD27257.

Endpoint Security Threat Prevention Extension HF1213762 has released and is mandatory before October 23, 2017

6/12/2017

IMPORTANT - Endpoint Security Threat Prevention Extension 10.5.2 Hotfix 1213762 has released and must be applied before the next Exploit Prevention content update, which is scheduled for October 23, 2017.
Extension HF1213762 keeps customized exploit prevention application protection rules from being reset to default when new exploit content is downloaded.
If you use Customized Application Protection Rules for Exploit Prevention this hotfix is mandatory. HF1213762 must be applied before the next Exploit Content posting is added to your local ePO repository. The next scheduled exploit content is October 23rd. Failure to do so will result in the loss of the customized Application Protection Rules in you ePO Exploit Prevention policies. You must manually recreate the custom policies. This extension can be used to manage all available versions of ENS 10.5 including ENS 10.5 patch 1.
For details, see the following documents:
Supported platforms, environments, and operating systems for Endpoint Security KB82761:
https://kc.mcafee.com/corporate/index?page=content&id=KB82761

Endpoint Security 10.x Known Issues KB82450:
https://kc.mcafee.com/corporate/index?page=content&id=KB82450

Endpoint Security 10.5.2 Threat Prevention Extension Hotfix 1213762 is mandatory before the next Exploit Prevention content update scheduled for October 17, 2017 KB89904:

McAfee Data Loss Prevention 11 hotfix 3 (11.0.0.3) Now Available

6/12/2017

McAfee Data Loss Prevention 11 hotfix 3 (11.0.0.3) is now available. This release includes new features, fixes, and enhancements including:
* All of the previous issues in 11.0.0.2
* 1202417 - The McAfee DLP Prevent appliance now synchronizes LDAP data from a single server in a domain-based configuration for a given base DN.
* 1202481 - This release fixes an issue in McAfee DLP Monitor where rules matching on email address regular expressions were case sensitive.
* 1202683 - This release fixes an issue in McAfee DLP Prevent and McAfee DLP Monitor where a policy push operation could not complete.
* 1204331 - This release fixes an issue in McAfee DLP Prevent where evidence copy failed if SMB v1 was disabled on McAfee ePO. The SMB package has been updated to allow communication with McAfee ePO using SMB v2 or v3.

To download McAfee Data Loss Prevention 11 hotifx 3 (11.0.0.3), go to the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.
For a full list of changes, see the Release Notes in [PD27299]: https://kc.mcafee.com/corporate/index?page=content&id=PD27299]
For a list of Known Issues, see [KB89301]: https://kc.mcafee.com/corporate/index?page=content&id=KB89301

McAfee DLP Prevent 10 Patch 2 Hotfix 6 (10.0.206) Now Available

6/12/2017

McAfee Data Loss Prevention (DLP) Prevent 10 patch 2 Hotfix 6 (10.0.206) is now available. This release includes new features, fixes, and enhancements including:

All of the previous issues resolved in 10.0.205
The McAfee DLP Prevent appliance now synchronizes LDAP data from a single server in a domain-based configuration for a given base DN.
For group information to be fully populated in the database, McAfee DLP Prevent now includes LDAP GUIDs in the user and group event information that it sends to McAfee ePO.
This release fixes an issue in McAfee DLP Prevent where evidence copy failed if SMB v1 was disabled on McAfee ePO. The SMB package has been updated to allow communication with McAfee ePO using SMB v2 or v3.

To download DLP Prevent 10 patch 2 Hotfix 6 (10.0.206), go to the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx

weebly
analytics