This document lists the new fixes and component versions in Symantec Endpoint Protection (SEP) 14.2 RU2 (14.2.2.0). This information supplements the information found in the Release Notes.
Download the full release through MySymantec. For details, see Download the latest version of Endpoint Protection.
You can also download client-only patches through Symantec Endpoint Protection 14.2 RU2 client-only patches.
Fix ID: ESCRT-2338
Symptoms: Symantec Endpoint Security (SEP 15) clients automatically upgrade to the latest available version, despite the Auto-Upgrade setting being disabled.
Solution: Changed null policy behavior so that Auto-Upgrade is disabled by default.
Fix ID: ESCRT-2323
Symptoms: 14.2 RU1 MP1 clients only attempt to connect to the parameters defined for System Proxy for SEPM communication.
Solution: Direct connection is now attempted prior to using the System Proxy connection.
Fix ID: ESCRT-2319
Symptoms: 14.2 RU1 MP1 Mac endpoints fail to connect to LiveUpdate when a System Proxy is configured.
Solution: Client configuration updated to properly honor the System Proxy configuration.
Fix ID: ESCRT-2300
Symptoms: Clients page of the SEPM does not display the correct IP address in the Last Connected field.
Solution: Updated SEPM reporting to show the correct Last Connected IP address.
Fix ID: ESCRT-2277
Symptoms: Terminal Server running Windows Server 2019 hangs intermittently and is no longer able to serve RDP sessions.
Solution: Addressed a deadlock between MountVol and Auto-Protect.
Fix ID: ESCRT-2251
Symptoms: SEPM built-in Database Backup utility displays the error “Network connectivity to the database server is not available.” for 14.2 RU1 MP1 with Microsoft SQL databases.
Solution: Updated JDBC implementation support to prevent an unexpected exception.
Fix ID: ESCRT-2220
Symptoms: When the SEP Firewall is intentionally disabled by policy the Windows Security Center displays a warning.
Solution: Corrected the status sent to Windows Security Center when the Firewall is installed, but in a disabled state via policy.
Fix ID: ESCRT-2143
Symptoms: Exchange 2013 and Exchange 2016 do not have the same exclusions as previous versions of Exchange.
Solution: Added complete Auto-Exclusion support for Exchange 2013 and Exchange 2016.
Fix ID: ESCRT-2118
Symptoms: Installing 14.2 RU1 on CentOS 7.5 with kernel version 3.10.0.862 results in a system crash.
Solution: Updated auto-compile script to build and load the proper Auto-Protect kernel modules.
Fix ID: ESCRT-2114
Symptoms: Local IP field incorrectly shows 0.0.0.0 for the IP address in Deception logs.
Solution: Updated Application Control logging to ignore non-valid IP addresses.
Fix ID: ESCRT-2046
Symptoms: After deleting, adding, or editing a replication partner, External Logging does not contain any of the details.
Solution: Added the event type in the event description for replication partner events in External Logging.
Fix ID: ESCRT-2016
Symptoms: Intermittent ccSvcHst.exe crash is observed on machines with extremely low memory conditions and high load.
Solution: Modified memory allocation requirements for logging structures.
Fix ID: ESCRT-1987
Symptoms: Intermittent ccSvcHst.exe crash observed on machines where many traffic events are logged and process memory exhaustion occurs.
Solution: Modified memory allocation requirements for logging structures.
Fix ID: ESCRT-1973
Symptoms: Attempts to create exception items for “Application to Monitor” and “Tamper Protection” via RESTAPI are unsuccessful.
Solution: Added support for the above exception types when using the RESTAPI.
Fix ID: ESCRT-1971
Symptoms: After a reinstall or upgrade of Symantec Endpoint Protection, if a rollback occurs further installation attempts are met with the error “Symantec Endpoint Protection services are stopped.”.
Solution: If a rollback occurs, the ccSettings key is only removed if it’s not pre-existing.
Fix ID: ESCRT-1953
Symptoms: Intermittent hang observed on Windows Server 2016.
Solution: Addressed a deadly embrace between MountMgr and Auto-Protect.
Fix ID: ESCRT-1933
Symptoms: Installing 14.2 RU1 on CentOS 7.6 with kernel version 3.10.0.957 results in a system crash.
Solution: Updated auto-compile script to build and load the proper Auto-Protect kernel modules.
Fix ID: ESCRT-1932
Symptoms: Intermittent ccSvcHst.exe crash is observed on machines with SEP Firewall installed.
Solution: Updated Traffic Security Engine parameters to improve file handling scenarios.
Fix ID: ESCRT-1926
Symptoms: Unable to create Linux File and Folder exceptions after enrolling an existing SEPM with the Symantec Endpoint Security Cloud Console.
Solution: Corrected a logic error to correctly separate Windows and Linux exceptions after SEPM Cloud enrollment.
Fix ID: ESCRT-1921
Symptoms: Clients receive an HTTP 412 error if the workgroup they reside in contains DBCS.
Solution: Changed the encoding used for certain fields to handle DBCS.
Fix ID: ESCRT-1887
Symptoms: Large temporary traffic log files with a .2 extension are found in the Windows\Temp folder.
Solution: Improved error handling when copying log files to temporary files.
Fix ID: ESCRT-1866
Symptoms: In a site with load-balanced SEPMs, some logs are not processed to External logging dump files or Syslog servers.
Solution: Updated the USN mechanism used when processing client logs in a load-balanced SEPM configuration.
Fix ID: ESCRT-1859
Symptoms: With auto-growth disabled, after a period of time the transaction log may become full and an error will be displayed during a SEPM upgrade to 14.2 RU1.
Solution: Added a new parameter to configure transaction log truncation during SEPM upgrade. Conf.Properties parameter: scm.upgrade.truncate.txnlog.enabled=false
Fix ID: ESCRT-1853
Symptoms: Intermittent ccSvcHst.exe crash is observed on machines with SEP Firewall installed.
Solution: Updated Traffic Security Engine parameters to improve file handling scenarios.
Fix ID: ESCRT-1836
Symptoms: The selected column order for Protection Technology view is not preserved after logging out and logging back in to the SEPM.
Solution: Fixed the initialization of the table for the Clients panel.
Fix ID: ESCRT-1829
Symptoms: When attempting to view the Computer Status log within the SEPM, the error message “Query Failed” is displayed.
Solution: Updated the table query to include the SERVICE_PACK column.
Fix ID: ESCRT-1820
Symptoms: There’s no Mac icon in the Server Control settings panel, which is used to indicate platform supportability.
Solution: Added Windows and Mac icons to the appropriate settings.
Fix ID: ESCRT-1798
Symptoms: /api/v1/policies/summary RESTAPI fails when the policy type contains >4,000 policies.
Solution: Updated the way the policies are retrieved from the SEPM database.
Fix ID: ESCRT-1795
Symptoms: After exporting Deception logs from the SEPM, some log entries contain a blank field for Caller Process Name.
Solution: Updated the query used when exporting Deception logs.
Fix ID: ESCRT-1793
Symptoms: Intermittent Unexpected Server Error displayed in the SEPM system log in environments that have many Group Update Providers.
Solution: Updated queries related to the GUP_LIST table.
Fix ID: ESCRT-1786
Symptoms: Limited Administrator accounts with Group/Package privileges are unable to export client installation packages after cloud enrollment.
Solution: Corrected Limited Administrator privileges when in a Cloud enrolled configuration.
Fix ID: ESCRT-1782
Symptoms: System hang observed on Windows Server 2016 virtual machines under certain conditions.
Solution: Updated the SEP client service to no longer attempt to display a window if there is no display connected.
Fix ID: ESCRT-1774
Symptoms: Active Directory imported clients are showing offline under the OU structure and appear in the default group as online.
Solution: Updated the API used to obtain the Domain Name, so that it includes the complete DNS name.
Fix ID: ESCRT-1765
Symptoms: Error displayed when attempting to use a % character in the DB user password for Windows Authentication.
Solution: Database User password validation updated.
Fix ID: ESCRT-1747
Symptoms: MoveClient RESTAPI failing for user-mode clients.
Solution: Updated query so that only active clients bound with the HWID will be moved.
Fix ID: ESCRT-1744
Symptoms: ccSvcHst.exe crash observed after a period of time.
Solution: Fixed a memory leak in ccSvcHst.exe related to Tamper Protection exclusions.
Fix ID: ESCRT-1723
Symptoms: SEPM is unable to send email notifications to a mail server configured to only support TLS 1.2.
Solution: Updated JavaMail to a version that supports TLS 1.2.
Fix ID: ESCRT-1718
Symptoms: Localized SEPM versions display a “Query Failed” error when attempting to view the details of a Risk within the Risk log.
Solution: Updated SEPM to use dynamic locale.
Fix ID: ESCRT-1708
Symptoms: The client uninstall password defined in the SEPM isn’t accepted on the endpoint with certain special character combinations.
Solution: Corrected an issue that caused the uninstall password to not be recognized by the endpoint.
Fix ID: ESCRT-1691
Symptoms: When using the smc -importconfig command via a script that doesn’t require a logged in user, it isn’t accepted.
Solution: Added support for using smc -importconfig without a logged in user.
Fix ID: ESCRT-1689
Symptoms: Attempting to install the SEPM fails during the GPOPolicyReview action, which is due to GPResult taking an extended period of time to return results in some environments.
Solution: Increased the timeout for GPOPolicyReview to 15 minutes.
Fix ID: ESCRT-1685
Symptoms: Sylink.xml dropped/imported on an endpoint results in Location Awareness no longer working until services restart.
Solution: Location Awareness functionality is no longer interrupted when a Sylink.xml is dropped/imported.
Fix ID: ESCRT-1624
Symptoms: Some endpoints incorrectly swept during nightly database maintenance activities.
Solution: Corrected a logic error to better handle clients that have certain flags associated with them.
Fix ID: ESCRT-1617
Symptoms: Failure to send RESTAPI commands to copied OU clients.
Solution: Updated queries to only apply to the active client.
Fix ID: ESCRT-1603
Symptoms: The in-product help page does not load when using the SEPM Remote Web Console.
Solution: Updated code to handle opening the HELP page when logged in using FQDN as host.
Fix ID: ESCRT-1590
Symptoms: SEP endpoints configured to use both SEPM and LiveUpdate to retrieve content appear to always try LiveUpdate first.
Solution: Updated code to check the package type from SEPM before choosing to download between LiveUpdate or SEPM.
Fix ID: ESCRT-1579
Symptoms: RESTAPI to query OU clients returns all clients that share one HWID, including deleted ones.
Solution: Added support for copied OU clients when using RESTAPI queries.
Fix ID: ESCRT-1575
Symptoms: The RESTAPI command GET /api/v1/computers returns duplicated OS information.
Solution: Updated code to remove the duplicate return results.
Fix ID: ESCRT-1570
Symptoms: If the proxy defined in IE is updated, LiveUpdate Engine on the endpoint does not recognize the change until it is restarted.
Solution: Updated logic so that Proxy information is checked prior to attempting to run LiveUpdate.
Fix ID: ESCRT-1556
Symptoms: When viewing the DB properties of a remote site from within the Symantec Endpoint Protection Manager, the username for the database of the local site is displayed instead of that for the remote site.
Solution: Database query modified to generate correct result
Fix ID: ESCRT-1543
Symptoms: A number of inconsistencies in dump file logging were identified that make it difficult for parsing to be automated. For example, paths alternately made use of backslashes and forward slashes.
Solution: Various changes to improve consistency including adding header file path and description, proper escaping of application names, and correcting header names.
Fix ID: ESCRT-1534
Symptoms: In Symantec Endpoint Protection Manager under logs and reports preferences, changes to the value for “Maximum number of rows in report table” cannot be saved. A user must manually enter this value when exporting a report.
Solution: Corrected preferences page so value can be saved successfully.
Fix ID: ESCRT-1495
Symptoms: An error may be generated when copying clients that are Active Directory sync enabled.
Solution: Modified Rest API to properly handle clients managed through Active Directory sync.
Fix ID: ESCRT-1428
Symptoms: The client fails connect to SEPM after receiving a HTTP 412 error if the hostname contains DBCS.
Solution: Modified SEP client to allow it to properly connect to a SEPM with a hostname containing DBCS characters.
Fix ID: ESCRT-1415
Symptoms: Client that had previously enrolled may not be able to re-enroll
Solution: Corrected setting of access token expiration timestamp in the SEP client.
Fix ID: ESCRT-1379
Symptoms: Auto Protect kernel modules must be built with CONFIG_TEPOINE supported GCC compiler or the kernel modules cannot load successfully.
Solution: Trigger autocompile of Auto Protect kernel modules for CentOS kernels.
Fix ID: ESCRT-1373
Symptoms: Clicking the risk name URL in the Risk Logs resulted in an error page
Solution: Fixed risk information URL in reports.
Fix ID: ESCRT-1347
Symptoms: Client counts are inaccurate in some reports if logged in as a limited admin.
Solution: Fixed filter query
Fix ID: ESCRT-1342
Symptoms: When attempting to view connection details, the UI populates the screen with data before immediately returning to the application list.
Solution: Correct Connection Details screen so that it will remain in view after populating.
Fix ID: ESCRT-1336
Symptoms: When installing the client, the PreferredGroup parameter is not honored and the client does not appear in its intended group.
Solution: Changes in 14.2 modified the default reconnection preferences causing the client to return to its last-used group setting. Modified these to return to prior behavior.
Fix-ID: ESCRT-1270
Symptoms: Query failed error displayed in Symantec Security Response panel of SEPM home screen
Solution: Query fixed to display correctly.
Fix ID: ESCRT-1268
Symptoms: Services are restarted when attempting to uninstall the SEP for Linux client
Solution: Added a check for the status of services prior to uninstall to avoid issue.
Fix ID: ESCRT-997
Symptoms: When attempt to use an FQDN to specify an email server in SEPM, the FQDN fails validation if it contains numbers.
Solution: Correct validation logic to allow numbers as a part of FQDNs.
Fix ID: ESCRT-987
Symptoms: When running German-language SEPM, attempting to expand clients under Virus Definition Distribution fails.
Solution: Fixed queries used in the report.
Fix ID: ESCRT-912
Symptoms: Attempting to download DPKG package downloads RPM package.
Solution: Browser is caching small files. Added a nonce to downloaded package name to ensure the filename is unique.
Fix ID: ESCRT-909
Symptoms: A SQL exception occurs during ADSI task if computer description fields exceed 256 characters.
Solution: Modified AD sync routine to truncate computer description to 256 characters.
Fix ID: ESCRT-864
Symptoms: Attempting to copy/past Mac or Linux exception policy fails as the Windows exception is always copied to the clipboard regardless of the platform selected.
Solution: Added platform info when copying items in Exception policy.
Fix ID: ESCRT-759
Symptoms: When cycling through the MSL, the client will stop attempting connections if it attempts to connect to a SEPM for which it cannot verify the signature in index2.html
Solution: Modified behavior of client so it will continue to attempt connection to the next server in the MSL under these conditions.
Fix ID: ESCRT-714
Symptoms: In profile.xml pusblished in data/outbox, some locations have the value Reverse DNS = 0 when it should be set to 1
Solution: Fixed the profile compilation of Reverse DNS in the Firewall policy.
Fix ID: ESCRT-707
Symptoms: After installing SEP with an install package which includes cleanwipe, cleanwipe is running as expected, the install package is installed correctly but a scheduled task named 'Symantec Cleanwipe' is left.
Solution:Cleaned up artifacts left by CleanWipe.
Fix ID: ESCRT-701
Symptoms: Unable to export computer status report
Solution: Refactored the query used in exporting Computer Status Logs.
Fix ID: ESCRT-692
Symptoms: Auto-upgrade to SEP 14.2.1015 version fails
Solution: Eliminate errant configuration information being written into client package.
Fix ID: ESCRT-671
Symptoms: An unlabeled checkbox is visible on the panel for LiveUpdate content type selection.
Solution: Corrected UI.
Fix ID: ESCRT-654
Symptoms: When using a non-English language SEPM, some content of the emailed scheduled Virus Definition Distribution report is in English.
Solution: Completed localization of the Virus Definition Distribution report.
Fix ID: ESCRT-650
Symptoms: Definition download log from GUP always reports "Throttle speed: 0.00 Kbps"
Solution: Corrected report so that throttle speed is accurately reported.
Fix ID: ESCRT-584
Symptoms: Client loses network connectivity for approximately two minutes at regular intervals if firewall is enabled.
Solution: Limit application learning AppInfoList to a maximum of 500.
Fix ID: ESCRT-578
Symptoms: In some circumstances, SEPM scheduled reports configured for “Past Month” do not include the first day of the month.
Solution: Correct report.
Fix ID: ESCRT-541
Symptoms: USB printers remain blocked when returning for an external location where printing is blocked to an internal location where printing is permitted.
Solution: Correct evaluation of USB blocking rules.
Fix ID: ESCRT-499
Symptoms: After SEPM enrolled to Cloud, Console still publish the ADC scan type of directory exceptions defined as ALL scan type in on-prem Exception policy.
Solution: Changed the publish algorithm behavior after SEPM has enrolled to Cloud.
Fix ID: ESCRT-400
Symptoms: Install Type is missing from exported Computer Status report
Solution: Fixed report to include install type.
Fix ID: ESCRT-399
Symptoms: Configuring the SymElam policy on SEPM to “Log the detection…” is not reflected on the SEP client.
Solution: Correct handling of this setting in construction of policy.
Fix ID: ESCRT-375
Symptoms: If all rules are removed for the SEP for Mac Firewall, the SEPM with report traffic is being blocked even though it is not.
Solution: Correct SEPM UI messaging.
Fix ID: ESCRT-354
Symptoms: Manual scan fails with “Scan Failure: Not enough free disk space to perform a scan.”
Solution: Corrected a problem where manual scans failed with disk space error when the username contained Unicode characters that do not match the current system locale.
Fix ID: ESCRT-349
Symptoms: Sorting of IPv4 address does not work correctly on the Clients tab.
Solution: Corrected sorting algorithm.
Fix ID: ESCRT-326
Symptoms: Navigating to Find Computers does not display the Find Computers dialog box.
Solution: Add null check while reading NetworkInterface from IP address.
Fix ID: ESCRT-322
Symptoms: When connecting to SEP client via RDP, the scan dialog for admin scheduled scans does not appear.
Solution: Fix UI so that scan dialog can be accessed during an RDP session.
Fix ID: ESCRT-318
Symptoms: Processing of Agent Behavior logs delayed due to blocked transactions on SQL Server
Solution: Fixed the table switching for log tables.
Fix ID: ESCRT-309
Symptoms: Missing information when the LiveUpdate is scheduled a certain way from the command line and then viewed from the command line.
Solution: Change logic to display status correctly.
Fix ID: ESCRT-288
Symptoms: When user tries to scan a folder, which has more than 100 files, using path with wildcards like '*', instead of scanning all the files in the folder, it will scan only 100 files.
Solution: Changed logic to notify the user that maximum input limit is reached and remaining files won't be scanned.
Fix ID: ESCRT-276
Symptoms: Password info is removed from ccSettings and registry causing the client to not accept any password for the UI and uninstall.
Solution: Corrected a timing issue where SEP password information was removed incorrectly.
Fix ID: ESCRT-247
Symptoms: ACLs for several folders do not include semsrv, semwebsrv, semapisrv. As a result, SEPM is unable to write content to disk.
Solution: Configure ACLs for related folders by PermissionDefinitions
Fix ID: ESCRT-244
Symptoms: A connection error message in SEP client "Troubleshooting->Server Connection Status"
Solution: Fixed SEPM to allow connection from a SEP client installed on the local system
Fix ID: ESCRT-220
Symptoms: Incorrect type of notification mailed out.
Solution: Set notification type for "file reputation" in upgrade.
Fix ID: ESCRT-136
Symptoms: SEP for Linux fail to download definitions for 14.2 because it is attempting to download the wrong file.
Solution: Fix SEP for Linux client so that it downloads the correct file from LUA.
Fix ID: ESCRT-51
Symptoms: IPS detection always uses the user name from main session in Security log even when user logs on from a remote RDP session uses different user name.
Solution: Correct reporting to get the correct user name and domain name.
The build number for this release is 14.2.5323.2000.
Red text indicates components that have updated for this release.
Component |
DLL File |
DLL Version |
SYS File |
SYS Version |
---|---|---|---|---|
AutoProtect |
srtsp64.dll |
15.7.6.28 |
srtsp64.sys |
15.7.6.27 |
BASH Defs |
BHEngine.dll Seq#= 20190927.005 |
12.0.2.10 |
BHDrvx64.sys |
12.0.2.10 |
BASH Framework |
BHClient.dll |
10.4.3.16 |
N/A |
- |
CC |
ccLib.dll |
13.4.3.6 |
ccSetx64.sys |
13.4.0.26 |
CIDS Defs |
IDSxpx86.dll Seq#= 20190828.500 |
17.2.1.16 |
IDSviA64.sys |
17.2.1.16 |
CIDS Framework |
IDSAux.dll |
15.2.6.22 |
N/A |
- |
CP3 |
version.txt |
2.8.0.39 |
N/A |
- |
CX |
cx_lib.dll |
3.0.3.25 |
N/A |
- |
ConMan |
version.txt |
2.1.8.5 |
N/A |
- |
D2D |
version.txt |
1.2.1.5 |
N/A |
- |
D2D_Latest |
version.txt |
1.5.0.51 |
N/A |
- |
DecABI |
dec_abi.dll |
2.3.5.10 |
N/A |
- |
DefUtils |
DefUtDCD.dll |
5.1.0.31 |
N/A |
- |
DuLuCallback |
DuLuCbk.dll |
1.8.1.17 |
N/A |
- |
DuLuxCallback |
duluxcallback.dll |
2.15.0.7 |
N/A |
- |
ERASER |
cceraser.dll |
119.1.0.93 |
eraser64.sys |
119.1.0.93 |
IRON |
Iron.dll |
7.0.7.12 |
Ironx64.sys |
7.0.7.11 |
LUX |
Lux.dll |
2.15.0.19 |
||
LiveUpdate |
LUEng.dll |
2.6.2.8 |
N/A |
- |
MicroDefs |
patch25d.dll |
6.1.1.4 |
N/A |
- |
SDS Engine |
sds_engine_x86.dll Seq#= 20191105.003 |
1.11.0.192 |
N/A |
- |
SIS |
SIS.dll |
14.0.2496.1001 |
N/A |
- |
STIC Defs |
stic.dll Seq#= 20190703.137 |
2.5.0.137 |
N/A |
- |
SymDS |
DSCli.dll |
6.2.1.3 |
N/A |
- |
SymEFA |
EFACli64.dll |
6.3.4.4 |
SymEFASI64.sys |
6.3.4.3 |
SymELAM |
ELAMCli.dll |
2.0.1.145 |
SymELAM.sys |
2.0.1.115 |
SymEvent |
Sevntx64.exe |
14.0.6.46 |
SymEvent.sys |
14.0.6.27 |
SymNetDrv |
SNDSvc.dll |
15.2.4.3 |
symnets.sys |
15.2.4.3 |
SymScan |
ccScanW.dll |
14.2.3.23 |
N/A |
- |
SymVT |
version.txt |
10.0.1.38 |
N/A |
- |
Symulator |
version.txt |
1.6.0.197 |
N/A |
- |
TCSAPI |
version.txt |
1.6.0.25 |
N/A |
- |
Titanium |
titanium.dll |
2.4.1.17 |
N/A |
- |
WLU (Symantec Endpoint Protection Manager) |
LuComServerRes.dll |
3.3.203.36 |
N/A |
- |