New fixes and component versions in Symantec Endpoint Protection 14.3 RU1

book

Article ID: 204064

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

This document lists the new fixes and component versions in Symantec Endpoint Protection (SEP) 14.3 RU1 (14.3.3384.1000). This information supplements the information found in the Release Notes.

  • New Fixes
  • Component versions


Download the full release through the Broadcom Software Download Portal. For details, see Download the latest version of Endpoint Protection.

Resolution

New fixes

SEP prevents user profile WER folders from being deleted at logoff

Fix ID: ESCRT-767

Symptoms: WER folders are not deleted on logoff.

Solution: Resolved a scenario that prevented the removal of a handle to the WER folders.

AD synchronization imports OU User userPrincipalName while clients check in using sAMAccountName

Fix ID: ESCRT-1053

Symptoms: Clients check-in to the Default Group using the sAMAccountName instead of the UPN.

Solution: Updated the API used to get the correct value.

Windows Server 2012 R2 hangs at login after a client upgrade and the first reboot

Fix ID: ESCRT-2299

Symptoms: Windows hangs on the first reboot post migration.

Solution: Corrected an intermittent problem where Windows would hang on the first reboot after migrating Symantec Endpoint Protection.

Invalid MAC addresses listed in network logs when Risk Tracer is enabled

Fix ID: ESCRT-2401

Symptoms: Local MAC field in client logging is showing an invalid format.

Solution: Updated the format to ensure the value is passed in the correct form.

SEP Firewall reverse DNS lookup is not resolving the DNS name

Fix ID: ESCRT-2618

Symptoms: SEP firewall is not resolving DNS under certain conditions.

Solution: Added support for compressed strings in DNS reverse response packets.

SEP Application Control log entries are truncated if it is longer than 512 characters

Fix ID: ESCRT-2984

Symptoms: Log entries in the Application Control can appear truncated if the associated path, key, or value is long.

Solution: Increased the character length support for Application Control logs.

SEP Application Control causes a delay for Chinese language input in Word and Excel

Fix ID: ESCRT-2997

Symptoms: Chinese character input is delayed for Word and Excel when Application Control is present.

Solution: Corrected a lock timing issue that caused a delay.

SEP Download Insight detects a file downloaded via a Trusted Domain

Fix ID: ESCRT-3031

Symptoms: Download Insight detects files downloaded via a Trusted Domain when an IP address is used instead of a URL.

Solution: Added support for IP addresses within Trusted Domain exclusions.

Firewall rules imported via command line are not saved on Windows 10

Fix ID: ESCRT-3098

Symptoms: Firewall rules imported via smc –importadvrule command are not saved on Windows 10.

Solution: Corrected an issue that prevented rules from saving when using the importadvrule command.

Bugcheck 0x34 on SymEFASI64.sys

Fix ID: ESCRT-3201

Symptoms: Intermittent system crash observed with SymEFASI64.sys.

Solution: Updated SymEFA to correct a scenario that could result in a system crash.

Missing description for SEPM Command Scan to identify which type applies each SEP Client

Fix ID: ESCRT-3338

Symptoms: There is no icon or description to identify which scan types are supported by which SEP Client in the SEPM Command Scan dialog window.

Solution: Added an OS icon ahead of each scan type.

Automatic exclusions missing for File Based Write Filter (FBWF) on Windows 7 Embedded

Fix ID: ESCRT-3355

Symptoms: Managed SEP client on Windows 7 Embedded with FBWF enabled is unable to update content without manual exclusions.

Solution: Automatic exclusions added to allow content to be updated on managed clients when FBWF is enabled.

IPS signatures display incorrect default values for Action and Log in the SEPM IPS Exclusion dialog

Fix ID: ESCRT-3368

Symptoms: Specific IPS Audit signatures display incorrect default values in the SEPM IPS Exception policy for Action and Log.

Solution: Corrected an issue that prevented the correct values for Action and Log from being displayed.

Location Awareness does not change locations as expected when Airplane Mode is enabled

Fix ID: ESCRT-3424

Symptoms: The SEP client does not change locations when Airplane Mode is enabled or all Network Adapters are disabled and the location condition “Client does not use any networking” is used as location change criteria.

Solution: Corrected an issue that prevented Location Awareness from identifying that no working interface is available.

ccSubSDK folder increases in size periodically

Fix ID: ESCRT-3437

Symptoms: ProgramData\Symantec\Symantec Endpoint Protection\<Version>\Data\CmnClnt\ccSubSDK increases in size when product submissions are unable to complete.

Solution: Implemented a file size limit for the ccSubSDK folder.

Details missing for Event Type: The computer account has been deleted

Fix ID: ESCRT-3495

Symptoms: Event Type: The computer account has been deleted contains no information about the event.

Solution: Added Computer Name to the event description for System Logs: Administrative in SEPM.

Cloud-managed SEP clients continue to download content on a LiveUpdate schedule when disabled

Fix ID: ESCRT-3518

Symptoms: System Policy is configured to disable the LiveUpdate schedule, but clients continue to run LiveUpdate.

Solution: Corrected a LiveUpdate trigger that would occur on client restart.

Clients with an IP address ending in .255 do not switch locations

Fix ID: ESCRT-3637

Symptoms: The SEP client does not change locations when the IP address ends in .255 and a location condition that relies upon IP address as location criteria is used.

Solution: Corrected an issue that prevented Location Awareness from evaluating a client ending with a .255 IP address.

Browser Protection events are not exported to a dump file

Fix ID: ESCRT-3702

Symptoms: The event type field is missing from Browser Protection events that are exported to a dump file.

Solution: Event Type column added to the external log-security file.

Windows Security Log contains Event ID 4673 with UAC enabled

Fix ID: ESCRT-3739

Symptoms: The Windows Security Log contains multiple Event ID 4673 events with UAC enabled and SEP installed.

Solution: Corrected an issue that resulted in continuous admin checks for the user session of ccSvcHst.exe.

Deadlock observed with Auto-Protect enabled alongside the Qualys Agent

Fix ID: ESCRT-3823

Symptoms: Unable to login to 3rd party application due to a deadlock between SRTSP64 and Qualys Agent.

Solution: Resolved an issue in Auto-Protect so that a lock is no longer required.

Credential Theft deceptor incorrectly triggers every 2 hours

Fix ID: ESCRT-3872

Symptoms: Clients intermittently trigger the Credential Theft deceptor on non-English operating systems.

Solution: Updated Credential, File, and DNS deceptor scripts to support non-English operating systems.

Bugcheck 139 on SymEFASI.sys

Fix ID: ESCRT-3883

Symptoms: Rare system crash observed on Windows Server 2012 that involves SymEFASI64.sys.

Solution: Added synchronization protection in several places for SymEFA.

Bugcheck on Windows 10 with Early Launch AntiMalware set to Good Only

Fix ID: ESCRT-3955

Symptoms: System crash observed when Early Launch AntiMalware is enabled and configured to “Good Only”.

Solution: Updated SymELAM to properly support updated boot-start drivers.

Locations do not change for an extended period of time

Fix ID: ESCRT-4076

Symptoms: When Cisco VPN is present and DNS Lookup is used as location criteria the location may not change immediately.

Solution: Location Awareness will now check location criteria again after Cisco VPN is ready.

Users are unable to disable the firewall even though the policy is configured to All Users

Fix ID: ESCRT-4132

Symptoms: Only Administrator accounts can disable Network Threat Protection or uncheck Enable Firewall.

Solution: Updated the SEP client to properly honor the All Users setting for limited users.

SEPM Administrators can create Single Risk Event notifications for domains they do not administer

Fix ID: ESCRT-4272

Symptoms: Single Risk Event notifications can be configured for all domains instead of the domain defined for the SEPM Admin account.

Solution: Updated Single Risk Event notification to honor the correct rights for the account creating it.

Bash.exe is not blocked by Application Control

Fix ID: ESCRT-4275

Symptoms: Application Control rules that would apply to Git Bash are not honored.

Solution: Updated Application Control to properly initialize and control Git Bash.

Virtual Image Exception tool is no longer functional after upgrading to 14.3

Fix ID: ESCRT-4321

Symptoms: VIETool.exe exits with an unexpected termination error and does not complete successfully with 14.3.

Solution: Addressed an issue where VIETool would fail to complete with error “Service terminated unexpectedly.”

Policies fail to import when FileLastModifiedDate is defined

Fix ID: ESCRT-4353

Symptoms: Policies with Network Monitoring enabled and Unmonitored Applications with FileLastModifiedDate defined do not import into the SEP client.

Solution: Corrected an issue where policies containing last fail date modified would fail to import.

Location Awareness conditions for DNS Server Address do not work as expected

Fix ID: ESCRT-4409

Symptoms: Location does not change as expected when an IPv6 DNS address is specified.

Solution: Updated location awareness to better handle special IPv6 DNS addresses.

Bugcheck 50 on SRTSP64.sys

Fix ID: ESCRT-4409

Symptoms: Intermittent system crash observed on Windows Server 2016.

Solution: Updated SRTSP to prevent the encounter of a scenario that could result in a system crash.

System hang observed after upgrade of the SEP client

Fix ID: ESCRT-4552

Symptoms: Immediately after upgrading the SEP client a rare system hang may be experienced after the first reboot.

Solution: Updated Application Control to prevent a scenario that could result in a system hang.

Symantec Endpoint Protection creates .dat files in Windows\Temp folder

Fix ID: ESCRT-4600

Symptoms: After upgrading to 14.3, a large number of .dat files are observed in the Windows\Temp folder on some systems.

Solution: Corrected an error in Common Client that resulted in extra .dat files being created when a problem is encountered.

SEP Mac SepInstallerApp crash observed after upgrading to 14.3

Fix ID: ESCRT-4636

Symptoms: SepInstallerApp crash observed intermittently when upgrading from a previous version of the SEP Mac client.

Solution: Resolved an issue that results in a possible SepInstallerApp crash when upgrading from a prior version of the SEP Mac client.

SEP EFAInst.exe crash observed during upgrade on Windows 7

Fix ID: ESCRT-4639

Symptoms: EFAInst.exe crash observed intermittently during upgrade of the SEP client.

Solution: Updated SymEFA to prevent the encounter of a scenario that could result in a EFAInst.exe process crash.

SEP Mac application firewall pop-ups observed with 14.3 MP1

Fix ID: ESCRT-4667

Symptoms: Non-configurable application firewall pop-up displayed in 14.3 MP1.

Solution: Added a check for the application firewall dialog window.

Intermittent definition corruption observed on SEP clients

Fix ID: ESCRT-4698

Symptoms: Definition corruption observed intermittently on SEP clients.

Solution: Resolved a rare scenario that prevented definitions from updating properly.

Client group changes in SEPM are not synced to the Cloud Console

Fix ID: ESCRT-4740

Symptoms: The removal and addition of client groups in SEPM are not always synced to the Cloud Console.

Solution: Updated CommonCloudHub to ensure that SEPM group changes are now always reflected on the Cloud Console.

SQL deadlocks observed after upgrading SEPM to 14.2 RU2

Fix ID: ESCRT-4749

Symptoms: Intermittent SQL deadlocks observed when processing Event notifications or with External Logging enabled.

Solution: Fixed a deadlock when updating the SYSTEM_STATE table.

ccSvcHst.exe crash observed intermittently

Fix ID: ESCRT-4928

Symptoms: ccSvcHst.exe periodically crashes with faulting module: ucrtbnase.dll.

Solution: Fixed a scenario that resulted in an exception encountered in ccSvcHst.exe.

Additional fixes for 14.3.3385.1000

SEPM upgrade to 14.3 RU1 encounters an error if a repair installation is performed

Fix ID: ESCRT-5679

Symptoms: SEPM upgrade to 14.3 RU1 is interrupted due to missing cryptoj.jar if a repair installation is performed.

Solution: Corrected an issue during repair installations that could prevent a specific JAR file from being placed in its proper location.

SEPM upgrade to 14.3 RU1 encounters a SQL Exception if database mirroring is enabled

Fix ID: ESCRT-5685

Symptoms: SEPM upgrade to 14.3 RU1 is unable to proceed if database mirroring is enabled. The following error is observed: "The operation cannot be performed on database "sem5" because it is involved in a database mirroring session or an availability group."

Solution: Corrected an issue that impacted support for database mirroring SQL Server configurations.

Component versions

The build number for this release is 14.3.3384.1000. 

Red text indicates components that have updated for this release.

Component

DLL File

DLL Version

SYS File

SYS Version

AutoProtect

srtsp64.dll

15.8.5.90

srtsp64.sys

15.8.5.75

BASH Defs

BHEngine.dll

Seq#= 20190927.005

12.1.0.271

BHDrvx64.sys

12.1.0.271

BASH Framework

BHClient.dll

12.1.0.271

N/A

-

CC

ccLib.dll

17.2.6.16

ccSetx64.sys

17.2.4.22

CIDS Defs

IDSxpx86.dll

Seq#= 20201022.022

17.2.4.18

IDSviA64.sys

17.2.4.18

CIDS Framework

IDSAux.dll

17.2.4.18

N/A

-

CP3

version.txt

2.10.0.84

N/A

-

CX

cx_lib.dll

3.2.0.93

N/A

-

ConMan

version.txt

3.3.0.313

N/A

-

D2D

version.txt

1.2.1.5

N/A

-

D2D_Latest

version.txt

1.5.0.61

N/A

-

DecABI

dec_abi.dll

2.3.5.10

N/A

-

DefUtils

DefUtDCD.dll

5.3.1.7

N/A

-

DuLuCallback

DuLuCbk.dll

1.13.0.86

N/A

-

DuLuxCallback

duluxcallback.dll

2.15.0.7

N/A

-

ERASER

cceraser.dll

119.1.1.39

eraser64.sys

119.1.1.39

IRON

Iron.dll

9.1.1.28

Ironx64.sys

9.1.0.27

LUX

Lux.dll

4.2.0.22

   

LiveUpdate

LUEng.dll

2.7.1.5

N/A

-

MicroDefs

patch25d.dll

6.2.2.13

N/A

-

SDS Engine

sds_engine_x86.dll

Seq#= 20201117.004

1.13.0.271

N/A

-

SEF Defs

speng32.dll

1.7.3.247

symevnt32.sys

1.7.3.161

SIS

SIS.dll

14.3.3228.1000

N/A

-

STIC Defs

stic.dll

Seq#= 20190703.137

3.3.0.138

N/A

-

SymDS

DSCli.dll

6.5.0.70

N/A

-

SymEFA

EFACli64.dll

7.4.0.125

SymEFASI64.sys

7.4.0.106

SymELAM

ELAMCli.dll

2.4.0.85

SymELAM.sys

2.4.0.83

SymEvent

Sevntx64.exe

14.0.7.107

SymEvent.sys

14.0.7.104

SymNetDrv

SNDSvc.dll

17.0.4.3

symnets.sys

17.0.4.3

SymScan

ccScanW.dll

16.2.0.46

N/A

-

SymVT

version.txt

10.2.1.10

N/A

-

Titanium

titanium.dll

2.6.0.77

N/A

-

WLU

LuComServerRes.dll

3.3.203.41

N/A

-