Symantec Protection Engine hotfixes for Decomposer vulnerabilities

Products

• Protection Engine for Cloud Services
• Protection Engine for NAS

Resolution

To mitigate the risks that Decomposer vulnerabilities pose, the following hotfixes are available for Symantec Protection Engine.

You must apply the appropriate hotfix attached in this article to your Symantec Protection Engine version.

Sr. No.	SPE Version	Hotfix Number	Download
1	SPE 7.0.0	HF02	SPE_7.0.0_HF02.zip
2	SPE 7.0.1	HF02	SPE_7.0.1_HF02.zip
3	SPE 7.0.2	HF11	SPE_7.0.2_HF11.zip
4	SPE 7.0.3	HF03	SPE_7.0.3_HF03.zip
5	SPE 7.0.4	HF02	SPE_7.0.4_HF02.zip
6	SPE 7.0.5	HF02	SPE_7.0.5_HF02.zip
7	SPE 7.5.0	HF06	SPE_7.5.0_HF06.zip
8	SPE 7.5.1	HF06	SPE_7.5.1_HF06.zip
9	SPE 7.5.2	HF08	SPE_7.5.2_HF08.zip
10	SPE 7.5.3	HF04	SPE_7.5.3_HF04.zip
11	SPE 7.5.4 (AWS Release)	HF02	SPE_7.5.4_HF02.zip
12	SPE 7.5.5	HF01	SPE_7.5.5_HF01.zip
13	SPE 7.8.0	HF03	SPE_7.8.0_HF03.zip

Applying the hotfix

For the detailed instructions on how to apply the hotfix, see the Readme.txt file in the zip file that you downloaded.

About the Decomposer vulnerabilities

For more information about the Decomposer vulnerabilities, see Advisory-I and Advisory-II.

How to check if the hotfix is applied (Decomposer version)?

To check if the hotfix is applied (Decomposer version) on SPE 7.8:

1. Stop the symcscan service.
2. Go to the SPE installation directory.
3. Run the command (Linux only): export LD_LIBRARY_PATH=/opt/SYMCScan/bin
4. Run the following command:
   • For Linux/Solaris: ./xmlmodifier -s //configuration/Logging/LogLocal/@loglevel 4 configuration.xml
   • For Windows: XMLModifier.exe -s //configuration/Logging/LogLocal/@loglevel 4 configuration.xml
5. Start the symcscan service.
6. Run the logconverter tool for current date SPE log and check the Decomposer version "5.4.7.5".

To check if the hotfix is applied (Decomposer version) on SPE 7.0.x and SPE 7.5.x:

1. Stop the symcscan service.
2. Go to the SPE installation directory.
3. Run the command (Linux/Solaris only): export LD_LIBRARY_PATH=/opt/SYMCScan/bin
4. Run the following command:
   • For Linux/Solaris: ./xmlmodifier -s //configuration/logging/loglocal/@value 4 configuration.xml
   • For Windows: XMLModifier.exe -s //configuration/logging/loglocal/@value 4 configuration.xml
5. Start the symcscan service.
6. Run the logconverter tool for current date SPE log and check the Decomposer version "5.4.7.5".

Note: You must revert the log level back to your previous settings after checking the Decomposer version.