Symantec released a patch that will resolve this issue for Symantec Endpoint Protection 11 and Symantec Endpoint Protection Small Business Edition 12 users. This patch is available via Public LiveUpdate, LiveUpdate, Administrator and LiveUpdate Administration Utility. It can also be downloaded directly from the Symantec FTP server. The vast majority of SEPM/SPC users will already be patched due to automatic LiveUpdates.
Note: If you do not wish to have your SEPM/SPC updated automatically, please see the section below titled: “Preventing LiveUpdate from updating SEPM/SPC”
under the SEPM and SPC Workarounds and Information section.
Manual Patch Installation Instructions:
Note: By default no action is required. The SEPM server will download and apply the patch automatically. This takes a total of three LiveUpdate cycles.
The SEPM downloads the patch on the first LiveUpdate session after the patch is made available, updates its Content Catalog on the first LiveUpdate session
after the patch is applied and downloads 2010 dated definitions on the third LiveUpdate session. This occurs without any user interaction over approximately 12 hours (assuming the default 4 hour LiveUpdate interval - 4 hours x 3 LiveUpdate sessions = 12 hours).
For un-patched SEPMs:
On January 1, 2010 Security Response altered their normal posting procedure of Multiple Daily Definitions (MDD) due to this issue. Symantec released definitions for Symantec Endpoint Protection (SEP) Clients and the SEPM once a day with a date of December 31, 2009. Symantec resumed normal posting of MDD for SEP Clients starting the evening of January 7, 2010 Pacific Time. A timeline for resuming MDD for the SEPM is still being finalized.
Security Response will continue to publish Symantec Endpoint Protection security content with the date 12/31/2009 rev. xxx (incrementing only the revision number) for SEPMs. The last certified definitions set published on December 31, 2009 was “12/31/2009 rev. 041” version. Unmanaged SEP Clients and Managed SEP Clients using LiveUpdate as their Security Content source will show the correct 2010 definition date.
Currently Symantec is still publishing 2009 dated content for AntiVirus and IPS/NTP definitions three times daily. Now that most customers have patched their SEPM and SPC servers to resolve the 2010 definition issue, Symantec plans to move back to the regular definition publishing schedule. This means phasing out the new 2009 dated content.
Here is the schedule for discontinuing the 2009 dated definitions:
1. As of Monday, February 8th (US PST), 2009 dated definitions will be published once per day.
2. As of Saturday, March 13th 2010, Symantec will no longer publish 2009 dated definitions on a regular schedule.
The last set of 12/31/2009 definitions published is: 2009/12/31 r.215 which equates the normal set dated: 2010/03/12 r.022
As such, all customers should allow their SEPM servers to download and apply the patch automatically, or manually patch their SEPM servers before March 13, 2010.
As of Sunday, February 7, 2010, the latest definition revisions for unpatched SEPMS are:
- Virus and Spyware Protection: Thursday, December 31, 2009 rev 189 This includes the same content as Sunday, February 7, 2010 rev 021
- Proactive Threat Protection: Thursday, December 31, 2009 rev 020
- Network Threat Protection: Wednesday, December 31, 2009 rev 015
Note:
It is important to recognize that although new security content updates will show a date of 12/31/2009, they will contain up-to-date content.
Relative definition age can be determined by the revision number.
SEP Client Workarounds and Information:
This section covers information for the Symantec Endpoint Protection Client product.
Client machines will continue to receive the latest protection available without any intervention from the user. Please be aware of the following exceptions:
- Rapid Release (RR) Antivirus and Antispyware definitions distributed using the Intelligent Updater (IU) and Certified definitions distributed using the IU, or downloaded directly from an Internal or Public LiveUpdate (LU) Server will reflect the actual publication date.
- Until this issue is resolved, clients updated with one of these IU packages will no longer update from a SEPM unless the LiveUpdate Content Policy is configured to force the client to use a specific update (See Configuring clients to download content from a LiveUpdate Server later in this section for further details).
- Clients using a Symantec Network Access Control (SNAC) Host Integrity (HI) Policy requiring a minimum Antivirus Signature File age may fail their HI Check.
- Until This issue is permanently resolved, HI policies should be modified to relax minimum Antivirus Signature File age requirements (See the SNAC Workarounds and Information Section for further details).
Configuring clients to download content from a LiveUpdate Server:
Managed SEP clients can be configured to download Security Content updates from an Internal or Public LiveUpdate Server. Clients configured in this manner will display the correct current Antivirus/Antispyware definitions date and revision, but will be unable to download and apply definitions from a SEPM until this issue is resolved, or the clients' LiveUpdate Content policy is configured to utilize a named definition revision.
Note:
Enabling client LiveUpdate will cause an increase in external network traffic as each client connects to the Internet to download virus definitions.
To correct the definition date showing on SEP 11.0.x and SEP 12.0 SBE clients, customers can configure clients to download the latest 'Virus and Spyware Protection' definitions directly from LiveUpdate. These definitions are properly dated as 2010 definitions.
- Click on the Policies Tab from within the SEPM Console
- Select LiveUpdate from the View Policies Pane
- Click on the LiveUpdate Settings Tab
- For Each LiveUpdate Settings Policy:
- Click on the LiveUpdate Settings Policy in the LiveUpdate Settings Tab
- Choose Edit the Policy from the Tasks Pane
- Select the Server Settings Tab In the LiveUpdate Settings policy Window
- Un-check the Use the default management server (recommended) Check Box
- Check the Use a LiveUpdate server Check Box
- Click OK to close the LiveUpdate Settings policy editor Window
Note:
Once a client has downloaded January 2010 definitions from LiveUpdate, the client should remain configured to download content from LiveUpdate until the SEPM has been patched with a fix for this issue. Once patches are available and this temporary problem has been corrected by Symantec, details will be posted to this KB article.
To prevent SEP clients from receiving FULL definition updates instead of Deltas after the SEPM is patched:
If the SEP clients have been configured to only receive content updates from the SEPM, no action is required. SEP clients will continue to receive delta definitions from the SEPM after it is patched.
If the SEP clients have been configured to receive content updates through LiveUpdate perform the following actions before reconfiguring clients to receive content updates through the SEPM:
- Continue updating clients through LiveUpdate
- Once the SEPM has a 2010 cached definition revision matching the 2010 definition revisions used by the SEP clients reporting to it, modify the LiveUpdate Content Policy to point clients back to the SEPM for Content Updates.
For further information on this procedure read Preventing Symantec Endpoint Protection (SEP) Clients from receiving FULL Antivirus/Antispyware definition packages from a patched Symantec Endpoint Protection Manager (SEPM) http://service1.symantec.com/support/ent-security.nsf/docid/2010010821395848.
SNAC Workarounds and Information:
This section covers information for the Symantec Network Access Control product.
There are two methods to prevent SNAC clients from failing HI checks due to outdated definitions:
- Configure clients to download the properly dated definitions directly from LiveUpdate. Refer to the SEP Customer Workarounds section, workaround number 2 (See Configuring clients to download content from a LiveUpdate Server later in the SEP Client Workarounds and Information section for further details)
- Increase the "number of days" setting in the client's Host Integrity Policy (See Modifying clients' SNAC HI Policy later in this section). Since the timelines for the fix are not available at this time, the suggested number is 30 days.
Modifying clients' SNAC HI Policy:
Steps to change antivirus/antispyware signature date in HI antivirus/antispyware requirement:
- On SEPM, click “Policies" then "Host Integrity”, then double click to open a specified HI policy, or click “Add a Host Integrity policy” to add a new one.
- Click “Requirements”
- Double click an existing antivirus/antispyware requirement, or click “Add…” to add a new antivirus/antispyware requirement
- There are several settings under “Antivirus Signature File Checking” (or “Antispyware Signature File Checking” for antispyware requirement). For example, check the option “Specify the oldest age of the signature file” and specify 30 days.
- Click “OK” button twice.
The steps to change antivirus/antispyware signature date in HI custom requirement:
- On SEPM, click “Policies" then "Host Integrity”, then double click to open the applicable HI policy, or click “Add a Host Integrity policy” to add a new one.
- Click “Requirements”
- Double click an existing HI custom requirement, or click “Add…” to add a new HI custom requirement
- Click “Add" then " IF..THEN..” (or right click somewhere in “Customized Requirement Script” to add an “IF..THEN..”, or click an existing “IF..THEN..” to edit it).
- Click “Select a condition:” to open the drop-down list.
- Select either “Antivirus: Antivirus signature file is up-to-date” or “Antispyware: Antispyware signature file is up-to-date”.
- There are several settings to check an antivirus/antispyware signature date. For example, check the option “Check if the age in days of the signature file is less than” and specify 30 days.
- Click “OK” button twice.
SEPM and SPC Workarounds and Information:
This section covers information for the Symantec Endpoint Protection Manager and Symantec Protection Center.
Related SEPM Issues:
Customers may also notice their SEPMs disk space gradually filling up with tmp folders in one of the following locations:
How to prevent LiveUpdate from updating SEPM/SPC:
It’s possible to prevent LiveUpdate from patching SEPM/SPC and resolving this issue, by creating registry keys on SEPM/SPC machines connecting to LiveUpdate.
This option is intended only for customers who have strict change control policies.
Important: Once this registry key has been created, customers must manually patch SEPM in order to download 2010-dated definitions. Manual patching tools will be posted to this KB article when available.
For 32-bit SEP 11.0.x customers:
On the SEPM machine, create the following DWORD registry key, and set the value to 0
HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\SEPM\AllowSoftwareLiveUpdate (DWORD) = 0
For 64-bit SEP 11.0.x customers:
On the SEPM machine, create the following DWORD registry key, and set the value to 0
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\SEPM\AllowSoftwareLiveUpdate (DWORD) = 0
For 32-bit SEP SBE 12.0.x customers:
On the SPC machine, create the following DWORD registry key, and set value to 0
HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\SPC\AllowSoftwareLiveUpdate (DWORD) = 0
For 64-bit SEP SBE 12.0.x customers:
On the SEPM machine, create the following DWORD registry key, and set the value to 0
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\SPC\AllowSoftwareLiveUpdate (DWORD) = 0
Do not be worried if you see a new LiveUpdate package downloaded to SEPM/SPC after Symantec posts a fix to this issue.
This package updates tracking data for the SEPM/SPC and does not update the server software.
To prevent SEP clients from receiving FULL definition updates instead of Deltas after the SEPM is patched:
If the SEP clients have been configured to only receive content updates from the SEPM, no action is required. SEP clients will continue to receive delta definitions from the SEPM after it is patched.
If the SEP clients have been configured to receive content updates through LiveUpdate perform the following actions before reconfiguring clients to receive content updates through the SEPM:
- Continue updating clients through LiveUpdate
- Once the SEPM has a 2010 cached definition revision matching the 2010 definition revisions used by the SEP clients reporting to it, modify the LiveUpdate Content Policy to point clients back to the SEPM for Content Updates.
For further information on this procedure read Preventing Symantec Endpoint Protection (SEP) Clients from receiving FULL Antivirus/Antispyware definition packages from a patched Symantec Endpoint Protection Manager (SEPM) http://service1.symantec.com/support/ent-security.nsf/docid/2010010821395848.
Addendum for Rapid Release Users:
This section covers information on using Rapid Release definitions.
In certain situations, Symantec Support will recommend the use of Rapid Release (RR) virus definitions during an active infection. As the RR Intelligent Updater (IU) definitions are dated normally, they will be removed immediately on a SEPM that has reached its threshold for definition revisions. There are two work-arounds that will allow the use of Rapid Release definitions:
Configuring the SEPM/Managed SEP clients to use Rapid Release Definitions:
This method will allow the SEPM to still serve normal certified definitions without any interruptions as well as Rapid Release definitions.
- Click on the Admin Tab from within the SEPM Console
- Click on the Servers Tab
- Click on the Local Site
- Click on Edit Site Properties from the Tasks Pane
- Click on the LiveUpdate Tab
- Increase the Number of content revisions to keep value by the number of Rapid Release definition sets expected to be needed
Each additional revision will allow the SEPM to hold one more Rapid Release definition set. A complete 32/64bit Virus Definition set consumes approximately 260MB per cached revision. Ensure you have sufficient disk space to store the additional definitions sets needed. This has the advantage that existing clients can continue to update using deltas, but the server must be able to handle the larger disk space utilization.
- Click OK to apply these changes.
- Apply the RR jdb file to the SEPM
- Click on the Policies Tab from within the SEPM Console
- Select LiveUpdate from the View Policies Pane
- Click on the LiveUpdate Content Tab
- Select the LiveUpdate Content Policy used by the clients requiring RR definitions and click Edit The Policy in the Tasks Pane
- Select the Security Definitions Tab on the LiveUpdate Content Policy Editor window
- Locate the Antivirus and antispyware definitions section and click the Edit button
- Select the correct RR revision from the drop-down list for both 32 and 64 bit Antivirus and Antispyware definitions.
- Click OK to close the revision selection window
- Click OK to close the LiveUpdate Content Policy Editor window
Configuring Managed SEP clients to no longer use Rapid Release Definitions:
- Click on the Admin Tab from within the SEPM Console
- Click on the Servers Tab
- Click on the Local Site
- Click on Edit Site Properties from the Tasks Pane
- Click on the LiveUpdate Tab
- Decrease the Number of content revisions to keep value by the same number of revisions this number was increased by to handle addition RR definition sets.
- Click OK to apply these changes.
- Click on the Policies Tab from within the SEPM Console
- Select LiveUpdate from the View Policies Pane
- Click on the LiveUpdate Content Tab
- Select the LiveUpdate Content Policy used by the clients currently using RR definitions and click Edit The Policy in the Tasks Pane
- Select the Security Definitions Tab on the LiveUpdate Content Policy Editor window
- Locate the Antivirus and antispyware definitions section and click the Edit button
- Select the latest revision of 12/31/2009 definitions from the drop-down list for both 32 and 64 bit Antivirus and Antispyware definitions.
- Click OK to close the revision selection window
- Click OK to close the LiveUpdate Content Policy Editor window
- After clients have successfully switched to the 12/31/2009 rev xxx definitions, re-edit the LiveUpdate Content Policy use "Use latest available"
- Run LiveUpdate on the SEPM immediately after making this policy change to ensure the RR defs are removed from the SEPM's definition cache
Addendum for LiveUpdate Administrator Users:
This section covers information on configuring LiveUpdate Administrator to update SEPM with the 2010 definition issue patch.
No changes are required for LiveUpdate Administrator (LUA) users unless:
- The SEPM is configured to download updates through LUA instead of Public LiveUpdate AND
- SEP Clients are configured to download updates from their SEPM.
For information on ensuring SEPM is capable of updating SEP clients with 2010 dated definitions downloaded via LUA read Downloading and hosting the Symantec Endpoint Protection Manager (SEPM) 2010 definitions patch via LiveUpdate Administrator (LUA) http://service1.symantec.com/support/ent-security.nsf/docid/2010010901022848