Symantec EDR 4.x firmware update procedures

Products

• Endpoint Detection and Response - Hardware

Issue/Introduction

You need to manually update the firmware and BIOS of your Symantec EDR hardware appliance.

Environment

Symantec S550/S450 appliance.

Cause

This update is required as the result of a software update to patch a security issue detected in the Symantec EDR hardware appliance.

Resolution

1.  Perform the upgrade to Symantec EDR 4.6.5-32.

2.  Log into the EDR serial console terminal (not ssh).

3.  At the admin prompt type:   get_firmware_version     

     Note the version string.

4.  At the admin prompt type:  firmware_update step1

   

If the version noted in step 3 is 0ACKP018, the host will automatically shut down.  Do the following:

              a.  Wait for the serial console terminal output to read "Power off".  

              b.  At the physical host, shut off the AC power and wait for the LEDs to go dark.

              c.  Turn the AC power back on.

              d.  Turn the host back on.

              e.  At the admin prompt type: firmware_update step2

                   It may take a while, but the host will eventually reboot.

              g.  When the host reboots, login as admin, and type:  get_firmware_version  

                   The version should be 0ACNU020.

 

If the version in step 3 is 0ACNU019, do the following:

              a.  At the admin prompt type: firmware_update step1                   

              b.  At the admin prompt type: firmware_update step2

                  The host will reboot.  This can take a while. 

              c.  When the host reboots, login as admin, and type: get_firmware_version

                   The version should be 0ACNU020.