Home | Skip to Content | Skip to Search | Skip to Navigation | Skip to Footer |
Worldwide [change] |Register |About Cisco
Guest

Hierarchical Navigation

Cisco Security Agent

Release Notes for Management Center for Cisco Security Agents 4.5.1

Downloads

Table Of Contents

Release Notes for Management Center for Cisco Security Agents 4.5.1 Revision 1

Installation Information

Obtaining a License Key

File Integrity Check Instructions

Product Notes

New Features

System Requirements (CSA MC)

SQL Server Desktop Engine Installation

System Requirements (Agent)

Upgrade Support

Duplicate Configuration Naming Convention

Internationalization Support

Internationalization Support Tables

Cisco Security Agent Policies

Policy Changes from CSA 4.5 to CSA 4.5.1

Policies Changed for Security Reasons

Policies Changed to Be Less Restrictive

Policies Changed for Efficiency Reasons

CSA MC Local Agent and Policies

RME Gatekeeper Remote Access Issue

Cisco VPN Client Support

Known Issues

Obtaining Documentation

Cisco.com

Documentation CD-ROM

Ordering Documentation

Documentation Feedback

Obtaining Technical Assistance

Cisco.com

Technical Assistance Center

Cisco TAC Website

Cisco TAC Escalation Center

Obtaining Additional Publications and Information


Release Notes for Management Center for Cisco Security Agents 4.5.1 Revision 1

These release notes are for use with Management Center for Cisco Security Agents (CSA MC) 4.5.1. The following information is provided:

•Installation Information

•Obtaining a License Key

•File Integrity Check Instructions

•Product Notes

•New Features

•System Requirements (CSA MC)

•System Requirements (Agent)

•Upgrade Support

•Duplicate Configuration Naming Convention

•Internationalization Support

•Internationalization Support Tables

•Cisco Security Agent Policies

•CSA MC Local Agent and Policies

•RME Gatekeeper Remote Access Issue

•Cisco VPN Client Support

•Known Issues

•Obtaining Documentation

•Obtaining Technical Assistance

•Obtaining Additional Publications and Information

Installation Information

This CSA 4.5.1 release is supported with VMS 2.3.

If you are upgrading from 4.x.x to 4.5.1 you already have VMS installed. If this is a new installation, it is recommended that you do not install other VMS products on the system to which are installing Management Center for Cisco Security Agents. Only install the "Common Services" needed for VMS in addition to CSA MC.

Caution When you install VMS 2.3, by default, checkboxes for several VMS products on the "Select Components" install screen are selected. You should click the Deselect button. Then select the "Common Services" checkbox and click Next to continue.

Obtaining a License Key

The Management Center for Cisco Security Agents CD contains a license key which is used to operate the MC itself. If you need further license keys, before deploying Cisco Security Agents, you should obtain a license key from Cisco. To receive your license key, you must use the Product Authorization Key (PAK) label affixed to the claim certificate for CSA MC located in the separate licensing envelope.

To obtain a production license, register your software at one of the following web sites.

If you are a registered user of Cisco.com, use this website:

http://www.cisco.com/pcgi-bin/Software/FormManager/formgenerator.pl.

If you are not a registered user of Cisco.com, use this website: http://www.cisco.com/pcgi-bin/Software/FormManager/formgenerator.pl.

After registration, the software license will be sent to the email address that you provided during the registration process. Retain this document with your VMS bundle product software records.

File Integrity Check Instructions

You can perform integrity checks on the files provided with Management Center for Cisco Security Agents 4.5.1. Use the verify_digests.exe file provided to check the MD5 hashes of the files.

When you run the verify_digests.exe file, you can enter the CD drive letter and check the files on the CD itself or you can copy the files to your system and check them from the directory to which they were copied.

The following output is displayed:

•The output displays "OK" if the hashes match and the files are valid.

•If the hashes do not match, "Failure" is displayed. Contact Cisco if this occurs.

How to install obtain and install VMS 2.3:

Step 1 If you have not received a CD containing VMS 2.3, you should download these four files: VMS-23-W2k-CD1-image-K9.z01, VMS-23-W2k-CD1-image-K9.z02, VMS-23-W2k-CD1-image-K9.z03, VMS-23-W2k-CD1-image-K9.zip from http://www.cisco.com/pcgi-bin/tablebuild.pl/vms into a scratch directory

Step 2 Run winzip on the fourth file and unzip the entire contents into a temporary directory. (You should find that you have 410 files occupying about 650MB of space.)

Step 3 Run vmmc_verify_digest.exe to ensure the integrity of your download.

Step 4 Run autorun.exe to begin the VMS 2.3 installation process. (When you install VMS 2.3, by default, checkboxes for several VMS products on the "Select Components" install screen are selected. You should click the Deselect button. Then select the Common Services checkbox and click Next to continue.)

Step 5 Complete the VMS 2.3 installation by rebooting your system when prompted.

How to install CSA MC V4.5.1:

Note The Management Center for Cisco Security Agents V4.5 kit is signed by Cisco Systems. This can be verified using Windows Explorer File ->Properties ->Digital Signatures.

Step 1 Open a command prompt window and cd into the product directory. Run setup.exe. Alternatively, you can use Windows Explorer to navigate to the product directory. Then, double-click the setup.exe file to begin the installation.

Step 2 You can now follow the standard installation directions provided in the Installation Guide. The Installation Guide appears as a PDF file in the Documentation directory at the top level.

Note The agent kits are provided in test mode in order to minimize any possible adverse impact of initial agent installation.

The provided policies are meant as a starting point to enterprise security. In general, you will want to run in test mode and create exceptions with the event wizard to create a suitable rule set for your environment. At that point, you can remove your agents from the test mode group and allow them to operate in protect mode. Test mode is turned on in the Auto-enrollment groups for each OS type. From the Group page, expand the Rule overrides section and uncheck the Test mode checkbox to turn test mode off for that group. Then Generate rules.

Product Notes

The following are issues that exist with the product, but are not product bugs. Therefore, they are not in the bug list.

•Issue: In some environments, the shipped installation policy may not allow non-standard installations. It is recommended that you tune the policy accordingly or stop the agent service to allow the installation.

Solution: You may change the File access control rule in this module to query the user if your security policy permits the use of the application in question.

–Issue: Linux Agent UI: For gnome desktop environments, the install script will only modify the default session config file for launching the agent UI automatically every time a user starts a gnome desktop session. But if a user already has their own session file ( ~/.gnome2/session ), the default session file (/usr/share/gnome/default.session) will not be effective. Therefore, the agent UI will not automatically start when the user logs in. In such a case, the user must add the agent UI (/opt/CSCOsca/bin/ciscosecui) manually (using "gnome-session-properties" utility) to make the agent UI auto-start. The user may also need to add a panel notification area applet to the control panel.

–Issue: Once a rootkit has been detected on a system, the rootkit system state is not removed until the system is rebooted.

Solution: Reboot system to reset rootkit system state.

–Issue: The pre-built reports configured for Analysis Deployment Investigation are meant as samples. You will likely have to edit or add to the existing report configurations to gather comprehensive information.

–Issue: Data access control rules for iPlanet running on Solaris systems are untested and unsupported. CSA ships with a data filter that you must manually install to use Data access control rules for iPlanet applications on Solaris. If you use this functionality, be aware that it is unsupported and that this filter may be removed in a future release.

–Issue: There have been issues with Compaq/HP Teaming and the Cisco Security agent (CSA). Symptoms include the NICs not being enabled automatically after an agent installation. This has to do with issues between Compaq/HP Teaming software and the agent's network shim. This is an example of the behavior: Installing CSA on an HP DL380G2 server with an HP-NC3163 Ethernet card disables the ethernet card. After CSA is installed, and before the PC is rebooted to complete the installation, the ethernet adapter is disabled.

Solutions: There are several different solutions to this issue:

•Do not install the network shim; it is an optional product.

•Reboot the system immediately after CSA is installed.

•Dissolve the team before installing CSA. Then, re-create the team after CSA has been installed.

There may be other issues between CSA's network shim and Compaq/HP Teaming and thus we highly recommend dissolving the team prior to installing CSA if you plan to install the network shim.

–Issue: The Desktop interface applications, client HTTP protocol rule in the Windows System Hardening module prevents Windows Find Files/Folders functionality from accessing sa.windows.com. When the rule is applied, the event text reads like this:

"The process 'C:\WINDOWS\explorer.exe' (as user HostName\Administrator) attempted to communicate with 10.123.124.125 on TCP port 80. The attempted access was to initiate a connection as a client (operation = CONNECT). The operation was denied."

The Windows search function is vulnerable to a redirection attack and the rule is designed to prevent just such an attack.

New Features

This release contains the following new features:

Displaying Packet Information in Human-Readable Form

For any event that provides packet information as part of the event details, that packet information can be displayed in human-readable form provided that "Ethereal" software is installed on the same system as CSA MC.

See the User Guide for links to Ethereal and instructions on how to read packet information.

Internationalization and Localization for Windows Agents

The Cisco Security Agent now accepts and displays query text characters appropriately for the supported, selected language type. Supported languages are Chinese (Simplified), French, German, Italian, Japanese, Korean, and Spanish. It also displays events in non-ASCII characters so that internationalization of events is possible. See Internationalization Support for details about language support.

Bulk Transfer of Hosts from Group to Group

This new feature allows you to search for all the hosts that meet a certain criteria and then act on the hosts found by that search. From the page displaying the search results you will be able to move or copy hosts from one group to another or delete hosts.

Update Groups Associated with Agent Kits

After an agent kit is made and deployed, new groups can be associated with the kit and existing groups can be removed from the kit.

One use for this feature is to prolong the life of installation images by requiring fewer changes to agent kits. For example, agent kits would most likely be deployed in test mode until all the rules, rule-modules, and policies are fine-tuned to meet the needs of your enterprise. An image installed on new desktops during the testing period would include an agent kit, which includes the Test Mode Systems group, which makes all other groups run in test mode.

Once the period of testing is over, the image deployed for new desktops would still include the Test Mode System group but it may no longer be needed because the rules and policies have been finalized and it is time to "go live" for some or all of your enterprise. This feature would allow you to remove the Test Mode System group from the agent kit that is currently included in the installation image for all desktops. When the agent on a new desktop registers with CSA MC for the first time, the Test Mode System group will be removed from the agent kit and the new desktop will not run in test mode.

Use Network Address Class Notation

You can now specify a range of IP addresses in network address sets using Network Address Class Notation. For example you can now specify a range using the syntax: 128.67.0.0/16. This indicates the range of addresses:

128.67.0.0 - 128.67.255.255

Cisco Trust Agent (CTA) Support

The Cisco Security Agent is a supported configuration for the Cisco Trust Agent feature for both CTA versions 1.0 and 2.0. For configuration details, please refer to the Cisco Trust Agent documentation.

CSA Supports the Distribution of a Wider Variety of CTA Installation Kits

After the installation of CSA MC you can copy additional CTA installer files to the system running CSA MC. When you create agent kits, you will be able to select from the different CTA installer kits. Some installer kits include the CTA supplicant, others do not.

System Requirements (CSA MC)

CSA MC is a component of the VPN/Security Management Solution (VMS).

For information on all bundle features and their requirements, see CiscoWorks2000 VPN/Security Management Solution Quick Start Guide.

Table 1 shows VMS bundle server requirements for Windows 2000 systems.

Table 1 Server Requirements

System Component
Requirement

Hardware

• IBM PC-compatible computer

• Color monitor with video card capable of 16-bit

Processor

1 GHz or faster Pentium processor

Operating System

Windows 2000 Server or Advanced Server (Service Pack 4)

Note Terminal services are not supported on Server and Advanced Server running CSA MC.

File System

NTFS

Memory

1 GB minimum memory

Virtual Memory

2 GB virtual memory

Hard Drive Space

9 GB minimum available disk drive space

Note The actual amount of hard drive space required depends upon the number of CiscoWorks Common Services client applications you are installing and the number of devices you are managing with the client applications.


•Pager alerts require a Hayes Compatible Modem.

•For optimal viewing of the CSA MC UI, you should set your display to a resolution of 1024 x 768 or higher.

•On a system where CSA MC has never been installed, the CSA MC setup program first installs MSDE with Service Pack 3a. If the CSA MC installation detects any other database type attached to an existing installation of MSDE, the installation will abort. This database configuration is not supported.

•If MSDE Service Pack 2 or earlier is present on the system, you must uninstall that version of MSDE or upgrade it before proceeding further.

SQL Server Desktop Engine Installation

As part of the installation process on a system where CSA MC has not previously been installed, the setup program first installs Microsoft SQL Server Desktop Engine (MSDE). You can use the included Microsoft SQL Server Desktop Engine (provided with the product) if you are planning to deploy no more than 500 agents. When the MSDE installation completes, it may prompt you to reboot the system. In that case, you must reboot the system before restarting the CSA MC setup program. If the MSDE installation does not prompt you to reboot the system, you may restart the setup program without rebooting the system.

Caution If the CSA MC installation detects any other database type attached to an existing installation of MSDE, the CSA MC installation will abort. This database configuration is not supported by Cisco. (Installation process aborts if any databases other than those listed here are found: master, tempdb, model, msdb, pubs, Northwind, profiler and AnalyzerLog.)

For a local database configuration, you also have the option of installing Microsoft SQL Server 2000 instead of using the Microsoft SQL Server Desktop Engine that is provided. Microsoft SQL Server Desktop Engine has a 2 GB limit. In this case, you can have CSA MC and Microsoft SQL Server 2000 on the same system if you are planning to deploy no more than 5,000 agents. Note that of you are using SQL Server 2000, it must be licensed separately and it must be installed on the system before you begin the CSA MC installation. (See the Installation Guide for details on installation options.)

We also recommend that you format the disk to which you are installing CSA MC as NTFS. FAT32 limits all file sizes to 4 GB.

System Requirements (Agent)

To run Cisco Security Agent on your Windows XP, Windows Server 2003, Windows 2000 or Windows NT 4.0 servers and desktop systems, the requirements are as follows:

Table 2 Agent Requirements (Windows)

System Component
Requirement

Processor

Intel Pentium 200 MHz or higher

Note Uni-processor, dual processor, and quad processor systems are supported.

Operating Systems

•Windows Server 2003 (Standard, Enterprise, Web, or Small Business Editions) Service Pack 0 or 1

•Windows XP (Professional or Home Edition) Service Pack 0, 1, or 2

•Windows 2000 (Professional, Server or Advanced Server) with Service Pack 0, 1, 2, 3, or 4

•Windows NT (Workstation, Server or Enterprise Server) with Service Pack 6a

•All Windows, Internet Explorer 4.0 or higher required.

Note Citrix Metaframe and Citrix XP are supported. Terminal Services are supported on Windows 2003, Windows XP, and Windows 2000. (Terminal Services are not supported on Windows NT.)

Supported language versions are as follows:

•For Windows 2003, XP, and 2000, all language versions, except Arabic and Hebrew, are supported.

•For Windows NT, US English is the only supported language version.

Memory

128 MB minimum—all supported Windows platforms

Hard Drive Space

15 MB or higher

Note This includes program and data.

Network

Ethernet or Dial up

Note Maximum of 64 IP addresses supported on a system.


Note Cisco Security Agent uses approximately 20 MB of memory. This applies to agents running on all supported Microsoft and UNIX platforms.

To run Cisco Security Agent on your Solaris server systems, the requirements are as follows:

Table 3 Agent Requirements (Solaris)

System Component
Requirement

Processor

UltraSPARC 400 MHz or higher

Note Uni-processor, dual processor, and quad processor systems are supported.

Operating Systems

Solaris 8, 64 bit 12/02 Edition or higher (This corresponds to kernel Generic_108528-18 or higher.)

Note If you have the minimal Sun Solaris 8 installation (Core group) on the system to which you are installing the agent, the Solaris machine will be missing certain libraries and utilities the agent requires. Before you install the agent, you must install the "SUNWlibCx" library which can be found on the Solaris 8 Software disc (1 of 2) in the /Solaris_8/Product directory. Install using the pkgadd -d . SUNWlibCx command.

Memory

256 MB minimum

Hard Drive Space

15 MB or higher

Note This includes program and data.

Network

Ethernet

Note Maximum of 64 IP addresses supported on a system.


Caution On Solaris systems running Cisco Security Agents, if you add a new type of Ethernet interface to the system, you must reboot that system twice for the agent to detect it and apply rules to it accordingly.

To run the Cisco Security Agent on your Linux systems, the requirements are as follows:

Table 4 Agent Requirements (Linux)

System Component
Requirement

Processor

Intel Pentium 500 MHz or higher

Note Uni-processor, dual processor, and quad processor systems are supported.

Operating Systems

RedHat Enterprise Linux 3.0 WS, ES, or AS

Memory

256 MB minimum

Hard Drive Space

15 MB or higher

Note This includes program and data.

Network

Ethernet

Note Maximum of 64 IP addresses supported on a system.


Upgrade Support

Upgrading CSA from versions earlier than Cisco Security Agent V4.0.X is not supported.

See "Installing Management Center for Cisco Security Agents" provided as a PDF file in Documentation directory on the product CD for product installation instructions.

Duplicate Configuration Naming Convention

Configuration items shipped with CSA MC and provided by Cisco contain a version column with a version number. Administrator-created items have no version number.

When you import configuration items provided by Cisco, if it is found that there is already an existing exact match for an item, the new configuration data is not copied over. Instead, the existing item will be reused and the name will reflect the new versioning.

If the import process finds that there is an existing item with the same name, the same version number, and different configuration components (variables, etc.), the newly imported item is changed by appending the name of the export file. The new item is always the item that the export file name appended to it. Existing items are not renamed or reversioned if there is a collision.

Also note that CSA MC automatically appends the name of the export file to any administrator configured item collision it finds during administrator imports. The imported item is given a different name and both new and old items can co-exist in the database.

Internationalization Support

All Cisco Security Agent kits contain localized support for English, French, German, Italian, Japanese, Korean, Simplified Chinese, and Spanish language desktops. This support is automatic in each agent kit and no action is required by the administrator. The agent UI, events, and help system will appear in the language of the end user's desktop.

The following table lists CSA localized support and qualification for various OS types.

Table 5 CSA Localizations

Language
Operating System
Localized
Qualified

Chinese (Simplified)

Windows 2000

Yes

Yes

 

Windows XP

Yes

Yes

 

Windows 2003

Yes

Yes

French

Windows 2000

Yes

Yes

 

Windows XP

Yes

Yes

 

Windows 2003

Yes

Yes

German

Windows 2000

Yes

Yes

 

Windows XP

Yes

Yes

 

Windows 2003

Yes

Yes

Italian

Windows 2000

Yes

Yes

 

Windows XP

Yes

Yes

 

Windows 2003

Yes

Yes

Japanese

Windows 2000

Yes

Yes

 

Windows XP

Yes

Yes

 

Windows 2003

Yes

Yes

Korean

Windows 2000

Yes

Yes

 

Windows XP

Yes

Yes

 

Windows 2003

Yes

Yes

Spanish

Windows 2000

Yes

Yes

 

Windows XP

Yes

Yes

 

Windows 2003

Yes

Yes


Explanation of terms:

Localized: Cisco Security Agent kits contain localized support for the languages identified in Table 5. This support is automatic in each agent kit and no action is required by the administrator. The agent UI, events, and help system will appear in the language of the end user's desktop. All localized languages are agent qualified and supported. (CSA MC is not localized.)

Qualified: The Cisco Security Agent was tested on these language platforms. Cisco security agent drivers are able to handle the local characters in file paths and registry paths. All qualified languages are supported.

Supported: The Cisco Security Agent is suitable to run on these language platforms. The localized characters are supported by all agent functions.

Refer to the following tables.

Internationalization Support Tables

The following tables detail the level of support for each localized version of Windows operating systems. Note that support for a localized operating system is different from localized agent. A localized operating system may be supported even though the corresponding language is not translated in the agent. In this case, the dialogs will appear in English. The tables below define the operating system support, not agent language support. Note, for Multilingual User Interface (MUI) supported languages, installs are always in English (Installshield does not support MUI), and the UI/dialogs are in English unless the desktop is Chinese (Simplified), French, German, Italian, Japanese, Korean, or Spanish.

Any Windows 2000, Windows XP or Windows 2003 platforms/versions not mentioned in the tables below should be treated as not supported.

The following letter combinations are used to describe the level of support:

Table 6

L

Agent localized, supported and qualified. (Note: L(S) - Localized and supported only)

T

Supported and qualified.

S

Supported but not qualified - Bugs will be fixed when reported by customers, but the exact configuration was not tested.

NA

Not applicable - Microsoft does not ship this combination.

NS

Not supported.


Support Level Key

Table 7 Windows 2000 Support

 
Professional
Server
Advanced Server

MUI

T

S

S

Arabic

NS

NA

NA

Chinese (Simplified)

L

L(S)

L(S)

Chinese (Traditional)

T

S

S

Czech

S

S

NA

Danish

T

NA

NA

Dutch

S

S

NA

English

L

L

L

Finnish

S

NA

NA

French

L

L(S)

L(S)

German

L

L(S)

L(S)

Greek

S

NA

NA

Hebrew

NS

NA

NA

Hungarian

S

S

NA

Italian

L

L(S)

NA

Japanese

L

L(S)

L(S)

Korean

L

L(S)

L(S)

Norwegian

S

NA

NA

Polish

S

S

NA

Portuguese

S

S

NA

Russian

S

S

NA

Spanish

L

L(S)

L(S)

Swedish

S

S

NA

Turkish

S

S

NA


Table 8 Windows XP Support

 
Professional
Home

Arabic

NS

NS

Chinese (Simplified)

L

L(S)

Chinese (Traditional)

T

S

Chinese (Hong Kong)

S

S

Czech

S

S

Danish

T

S

Dutch

S

S

English

L

L

Finnish

S

S

French

L

L(S)

German

L

L(S)

Greek

S

S

Hebrew

NS

NS

Hungarian

S

S

Italian

L

L(S)

Japanese

L

L(S)

Korean

L

L(S)

Norwegian

S

S

Polish

S

S

Portuguese

S

S

Russian

S

S

Spanish

L

L(S)

Swedish

S

S

Turkish

S

S


Table 9 Windows 2003 Support

 
Standard
Web
Enterprise

Chinese (Simplified)

L

L(S)

L(S)

Chinese (Traditional)

T

S

S

Chinese (Hong Kong)

S

S

S

Czech

S

S

S

Dutch

S

NA

NA

English

L

L

L

French

L

L(S)

L(S)

German

L

L(S)

L(S)

Hungarian

S

S

S

Italian

L

L(S)

L(S)

Japanese

L

L(S)

L(S)

Korean

L

L(S)

L(S)

Polish

S

S

S

Portuguese

S

S

S

Russian

S

S

S

Spanish

L

L(S)

L(S)

Swedish

S

S

S

Turkish

S

S

S


On non-localized but tested and supported language platforms, the administrator is responsible for policy changes arising from directory naming variations between languages.

If the previous operating system tables do not indicate that CSA is localized (L) then the system administrator is responsible for checking to ensure that the tokens are in the language they expect and the directory path is the one they intend to protect. See Installing Management Center for Cisco Security Agent, Revision 1 for the procedure to determine if language tokens are correct.

Cisco Security Agent Policies

CSA MC default agent kits, groups, policies, rule modules, and configuration variables provide a high level of security coverage for desktops and servers. These default agent kits, groups, policies, rule modules, and configuration variables cannot anticipate all possible local security policy requirements specified by your organization's management, nor can they anticipate all local combinations of application usage patterns. We recommend deploying agents using the default configurations and then monitoring for possible tuning to your environment.

Policy Changes from CSA 4.5 to CSA 4.5.1

Changes to rules in CSA 4.5.1 were made to increase security, be less restrictive, or be more efficient. After you upgrade from 4.5 to 4.5.1, look for evidence of a rule change in the rule module list page or policy list page in CSA MC. If a rule has changed you will see a 4.5.1 version of a rule module or policy alongside the rule modules and policies of previous versions.

You can easily compare the new policy to the old policy to see exactly what changed. See the "Using Security Management Center for Cisco Security Agent" manual for information about the Compare Tool.

Policies Changed for Security Reasons

Security changes were made to enforce stricter security where it was needed. These policies changed to provide greater security:

Cisco Trust Agent - Windows: One rule in the Network Admission Control Quarantine Module was changed so that it is now shipped as "disabled" rather than "enabled." The rule prevents all network access outside the system except by Cisco Trust Agent (CTA) and by anti-virus software. The rule protects networked assets but also prevents the local agent from being remediated. This rule was disabled, and not removed, because the rule could be used as a template for a rule which better suits your individual enterprise.

Microsoft SQL Server 2000 - Windows: Two rules were changed to provide proper access to .ndf files. So that Microsoft SQL Server 2000 could access its own .ndf file type, MS SQL Server Services and MS SQL user applications were explicitly allowed to read and write .ndf files. To prevent access to .ndf files from "vulnerable applications," these applications were explicitly denied write access to .ndf files.

Operating System - Base Permissions - Solaris: The System Hardening Module (Solaris) was changed to prevent a telnetted buffer overflow attack documented in the CERT (Computer Emergency Response Team) advisory, CA-2001-21.

Operating System - Base Protection - Solaris: The System Hardening Rule Module (Solaris) was changed to prevent known exploits against sadmin daemon. By default, the tool starts in a weak authentication mode and can be easily spoofed. The sadmin daemon is not necessary and the rule prevents it from being started.

MS Management Applications application class. A change to the MS Management Applications applications class changed rules in several policies. The application class was changed because it referred to any mmc.exe executable in any path. Now the application class references only the explicit path to mmc.exe. This change prevents Trojan Horse attacks. These policies were affected by this change:

•DHCP Servers - Windows

•DNS Servers - Windows

•Operating Systems - Base Permissions - Windows

•Web Server - Microsoft IIS - Windows

•Microsoft SQL Server 2000 - Windows

Policies Changed to Be Less Restrictive

Some changes were made to make rule modules and policies less restrictive. Often these changes were made by adding new rules, which allowed more behavior, to rule modules. These changes will help new customers during the pilot phase of CSA by reducing the number of denials that require investigation.

These policies were made less restrictive:

•Application Classification

•General Applications - Base Security - Windows

•General Applications - Multi-level Security - Windows

•Installation Applications - Solaris

•Installation Applications - Windows

•Operating System Base protection - Linux

•Web Server - Apache

Policies Changed for Efficiency Reasons

Efficiency changes were made by combining rules to reduce the overall number of rules, expanding application classes to include more commonly used text editors, and by enhancing rule descriptions. These changes do not change the security benefit of a rule.

These policies were made more efficient:

•E-mail Client - Basic Security - Windows

•E-mail Client - Multi Level Security - Windows

•Network Personal Firewall

•Operating System - Base Protection - Windows

•Web Browser - Linux

•Web Server - Apache

CSA MC Local Agent and Policies

When you install CSA MC, an agent containing the policies necessary to protect a system only running CSA MC and Security Monitor as part of your VMS bundle on the CiscoWorks system (the recommended configuration) is automatically installed as well. The policy in question contains a "restrictive" rule module which puts tighter restrictions on the system because it does not have to account for other VMS bundle products that might be running on the system.

If you are running additional products as part of your VMS bundle on the CiscoWorks system, you must remove the CiscoWorks Restrictive VMS Module from the CiscoWorks VMS Systems policy in order to allow this additional software to operate.

To do this, navigate to Configuration>Policies and locate "VMS CiscoWorks - Windows" in the list of policies. Click on the "VMS CiscoWorks - Windows" policy. This takes you to the main policy page with the list of rule module associations. Click the Modify rule module associations link. Locate the "CiscoWorks Restrictive VMS Module" in the right-side Attached rule modules swap box. Select this module and click the Remove button. Then Generate rules. (Note that this is not the recommended deployment.)

Caution If you are installing or uninstalling various VMS components, and you have a Cisco Security Agent protecting the VMS bundle, you should disable the agent service before you install or uninstall of any other VMS component. (You do not have to do this when installing or uninstalling CSA MC.) To disable the agent service, from a command prompt type net stop "Cisco Security Agent". (You may receive a prompt asking if you want to stop the agent service. You should click Yes.) To enable the service, type, net start "Cisco Security Agent".

If you do not disable the agent service and you attempt to alter a CiscoWorks system configuration, the agent may disallow the action or it may display multiple queries to which you must respond.

RME Gatekeeper Remote Access Issue

It is recommended that you do not install other VMS products on the system to which are installing Management Center for Cisco Security Agents. However, if you do not follow this recommendation, you should be aware of the following.

Remote access to the CiscoWorks RME Gatekeeper daemon is not required for correct operation of any of the components in the VMS bundle. Therefore, remote client access to this daemon is normally disabled through a deny rule in the "CiscoWorks VMS Module" within the CiscoWorks VMS Policy.

If other products that require the RME Gatekeeper daemon to be accessed remotely, such as Campus Manager or ACLM, are installed on the same system as the VMS bundle, the CSAMC "CiscoWorks VMS Module" protecting the VMS system should be modified as follows:

Step 1 Login to CSAMC and navigate to the "CiscoWorks VMS Module" in the VMS CiscoWorks Policy. The module is accessible from Configuration>Rule Modules [Windows] in the menu bar.

Step 2 Once you locate the module, you don't have to click on the module name. You can click the <#> rules link to access the rules list directly.

Step 3 From the "CiscoWorks VMS Module" rule list, change the Allow rule "CiscoWorks RME Gatekeeper daemon, server for TCP and UDP services" from Disabled to Enabled. (Select the checkbox beside the rule and click the Enable button in the footer frame of CSAMC. Remember to save your changes.)

Step 4 Generate rules.

Step 5 Optionally, force polling on the agent to download the rule change.

Cisco VPN Client Support

Cisco Security Agent is a supported configuration for the "Are You
There?" feature of the Cisco VPN Client, Release 4.0. For configuration
details, please refer to Chapter 1 of the Cisco VPN Client Administrator
Guide, in the section entitled "Configuring VPN Client Firewall Policy—Windows Only."

Known Issues

Table 10 provides information on known issues found in this release.

Table 10 Known Issues in Cisco Security Agent 4.5

Bug ID
Summary
Explanation

CSCec61813

CSAMC authentication fails when spawned from explorer.exe

Symptom:The Cisco Security Agent Management Console is typically accessed through a web browser. In the case of Internet Explorer, one can place a URL string in the address bar of the Windows file explorer and it will start to act like a limited functionality browser.

Conditions:Administrator performing maintenance tasks on CSA MC.

Workaround:Do not invoke a session to browse to an external site such as CSA MC. A supported web browser must be used. Consult the Installation Guide for these requirements.

CSCed17183

Cannot view ActiveX reports without using fully qualified CSA MC name

Symptom:Browsing to CSA MC without using the "full" MC name (e.g. "machine" instead of "machine.mycompany.com") will result in the inability to view ActiveX reports on the MC.

Workaround:For proper viewing of CSA MC ActiveX reports, make sure to use the fully qualified name when browsing to the MC.

CSCed45830

CSA Certificate does not comply with RFC2396

Symptom:The Cisco Security Agent and the CSA Management Console share a certificate to insure trusted communication. It has been reported that the certificate does not "fully" comply with RFC 2396.

Workaround:None at this time. It is considered an enhancement request to add support for third party certificates.

CSCee45283

There is no VMS policy for running VMS on Solaris.

Symptom:The Cisco Security Agent ships with a default policy to defend the VMS system that CSA MC is installed on. This policy is tuned to allow the normal operation of the CSA MC. VMS also supports running VMS components on Solaris systems. However, CSA MC does not run on a Solaris environment.

Conditions:Customers with VMS installed on Solaris.

Workaround:It is suggested that the Customer initially deploy the Solaris Servers kit in TESTMODE. This will allow the admin to tune the rules on this server without imposing unwarranted events from the Cisco Security Agent.

CSCee61396

Overlay agent install does not enable previously disabled csauser / shims.

Symptom:To solve specific customer issue, the CSA escalation team will, from time to time, ask the customer to disable various drivers in the CSA agent. This disable is not respected when the agent is upgraded from release to release. This will cause the previous issue to re-surface.

Conditions:Agent upgrades occur. Previous resolved issue returns.

Workaround:Manually re-apply the driver disable steps.

CSCee62597

The Solaris agent does not allow netbackup to backup agent files.

Symptom:Netbackup is not allowed to backup the agent files.

Workaround:This situation is true of any backup application that attempts to archive the agent files and uses a "write flag" in their file operation. The workaround that has been presented to several customers is to configure the backup system not to archive the agent files. To enable the agent to permit the backup of its own files would be compromising the agent's built-in self protection.

CSCee82644

Detect agent UI disabled if uninstalling CSA MC

Symptom:If the Cisco Security Agent user interface is not present (not enabled for the user), then the user receives no popup query when attempting actions such as stopping the agent.

Workaround:Warn user that the agent UI is disabled and they cannot stop the agent service if CSA MC is uninstalled. Or, you can enable the agent UI for the user. Then this issue does not arise.

CSCef16814

Unix non-root users should have access to UI

Symptom:Currently non-root users on Solaris do not have access to the agent ./csactl utility. Therefore they cannot poll for new rules or perform software updates.

Workaround: None at this time. Polls will continue to occur at regular intervals determined by the group parameter for polling.

CSCef17103

CSA and AFS (Andrew File System) are incompatible on Solaris 2.8.

Symptom: It has been reported that the AFS (Andrew File System) is not compatible with the Cisco Security Agent on Solaris 2.8.

Workaround: None at this time.

CSCef22643

Request to have CSA alerts include the parent process with the child process.

Symptom: When a descendent of a process is blocked, it would be useful to also list the parent process in the alert. For example, if one program is prevented from writing executable files and it is a dependent of another program, the alert displays the child program but does not mention the parent process. This makes the alerts harder to understand.

Workaround: None at this time.

CSCef38271

Unicode characters are not supported for CSA MC reports.

Symptom:Because CSA MC generated reports do not support Unicode characters, some report fields (e.g. filename) may contain nonsense characters on internationalized versions of CSA.

Workaround:There is no known workaround.

CSCef69413

ASC query is displayed in the wrong session.

Symptom:When running in a multiple display environment (Terminal Services or Citrix), the Cisco Security Agent makes every attempt to locate the user triggering the security query and display the query dialog in the session the local user in.

Workaround: None at this time.

CSCef85937

Blue Bar for login screen on WinXP-sp2 corp IT image and SOE images

Symptom: After reboot, instead of a login screen, the user sees a blank screen with only a blue bar. This blue bar normally appears on the Windows logo screen, but instead of the logo screen, only the blue bar is displayed. This is indicative of the logon is being impeded by CSA.

Workaround: It has been determined that this typically occurs on Windows XP systems with Service Pack 2 installed. The Cisco Security Agent engineering team has implemented a partial workaround that requires CSA v4.5.1. In CSA 4.5.1, the rules now control whether one of the Clipboard rule's hook is installed. If there are no Clipboard rules in effect, then this hook is not inserted during logon. This will resolve the blue bar problem in this case.

In order to get the keyboard hook installed after adding a clipboard rule, you will need to reboot your system. Before the reboot, the PrtScrn key will not be hooked. And the user should be aware that after reboot with a clipboard rule, the system may again experience the blue bar issue.

The Cisco Security Agent engineering team is continuing to trace the root of this issue.

CSCef96134

Behavior analysis creates incorrect rule modules at times.

Symptom:Behavior analysis creates incorrect rule module when file/data streams are used.

Workaround: Run the Behavior analysis job but manually delete all data/file stream references (the colon and all information after it).

CSCeg30323

Analysis reports do not detect outlook express and media player.

Symptom:Application Analysis fails to report windows components such as Outlook Express and Mediaplayer unless they are patched.

Workaround:None at this time.

CSCeg51694

For a forced reboot configuration, minutes and seconds are not translated.

Symptom:On the forced reboot message after installing an agent kit, it reads "5 minutes, 00 seconds" regardless of OS language type.

Workaround:None at this time.

CSCeg56326

Test mode does not apply to the service restart rule.

Symptom:Service restart rules do not switch to TESTMODE. TESTMODE is the agent state where rules log "what would have happened" but do not enforce any policies on the system. The Service restart rule will restart the service it was monitoring regardless of the agent state.

Workaround:None at this time.

CSCeg57681

Cannot navigate keyboard in Linux query challenge.

Symptom:Unable to navigate using only the keyboard as input on the Linux query challenge dialog.

Workaround:Cisco Security Agent on Linux must use a pointer device (mouse, etc) to direct input in the Linux query challenge dialog.

CSCeg60208

False positive using Netmeeting directory on W2K.

Symptom:The use of NetMeeting in a domain environment produced certain events. These events are not due to malicious behavior on the part of NetMeeting.

Workaround: It is advisable for the administrator to use the event wizard to tune the default desktop group's policies to allow NetMeeting to operate in the network environment.

CSCeg71633

Report engine design cannot support multiple administrators.

Symptom:Two administrators log into CSA MC from different systems and they both proceed to the same report (e.g.default report that is currently unmodified). The first administrator changes the parameters of the report and selects "View Report". The second administrator accesses the same report and selects "View Report".

The second administrator believes he/she is viewing the default report. But this administrator is actually viewing the report that the first administrator is configuring despite the fact that the first administrator never "Saved" the changes. Further, there is no way to revert.

Workaround:Exercise care in administering a system where more than one administrator could be running reports at one time.

CSCeg75348

Application control rule allows All applications in both application fields.

Symptom: Configuring an Application control rule allows "All Applications" to be selected for both application class fields. This results in the following warning: "Dangerous application class selection (might render the system unusable)." Although this warning does appear the user is still allowed to proceed and generate the rule. This could cause systems become inoperable.

Workaround: Administrators should be aware of this condition and exercise care in creating an Application control rule that uses All applications in both fields.

CSCeg76282

There is no way to enable security if agent UI is not present.

Symptom:If the administrator disables the display of the agent UI after agent kits are deployed, there exists a rare condition that a host with security suspended during the disable of the UI display will not be able to restore the security level to the agent once the UI disappears.

Workaround:There are two methods to correct this situation - Use the Reset feature from local host's Start menu - Or use the Reset feature from the CSA MC to remotely reset the agent.

CSCeg87069

Policies that ship with CSA MC for Linux interfere with automounter.

Symptom:Default Linux policies interfere with the operation of the automounter.

Workaround:A workaround is to create exceptions for /usr/sbin/automounter from Buffer overflow rule terminate actions in the Linux policies.

CSCeg87071

Policies that ship with CSA MC for Linux interfere with RedHat RedCarpet Daemon.

Symptom:An optional Red Hat Linux utility that automatically patches the operating system - the Red Carpet daemon - when run in the presence of default Linux policies, generates events.

Workaround:Use the wizard to tune the default policies to allow the Red Carpet daemon to run less noisily.

CSCeg88921

Newly installed COM objects are not protected by the agent until the system is rebooted.

Symptom: With an agent already installed and running on a Windows host, if a new MS Office application is installed, the COM objects it installs are not recognized by the agent and therefore are not protected by COM component access rules.

Workaround: The system must be rebooted or the agent service stopped and restarted. At that time, the agent will register the new COM objects.

CSCeg90229

If the CTA installation fails, CSA refers to non existent CTA log file.

Symptom:The Cisco Trust Agent is optionally installed with the Cisco Security Agent on any Windows platform. On Windows NT, the CTA installer fails because it is not a supported platform. The error presented contains a path to a non-existent log file.

Workaround:None at this time. Windows NT is an unsupported CTA platform. Windows NT is a supported CSA platform.

CSCeh03415

The agent requires stop/start to register after 3.2->4.0.3->4.5 upgrade.

Symptom:After Migrating from 3.2 to 4.0.3.760 and subsequently to version 4.5, the agent will not register properly with the MC. It requires a stop/start of the agent service in order to allow the agent to register. However, after registering, the agent is still not associated with any groups.

Workaround:On the next poll or restart of the agent, it is allowed to register, as a NULL registration. Because of the NULL registration however, the administrator must then associate the agent with the desired groups in order for any rules to be enforced on the agent.

CSCeh06088

File access control Directory protection does not protect symlinks in path.

Symptom:If a File access control rule is created to deny <All applications> write directory actions upon a file literal whose path includes a symbolic link (/opt/sfw/bin/* for example, where /opt/sfw is a symbolic link to another directory) the symbolic link itself can still be renamed.

Workaround:Protect the symbolic link itself by denying read/write permission to it literally. In the above example, the File access control rule would include the file literal "/opt/sfw".

CSCeh17492

File protection is still operative after the entry is deleted.

Symptom:If the local File protection feature on the agent is modified. The protection enforced takes a short period of time to synchronize the changes.

Workaround:Waiting a short period of time will allow the change to register in the system.

CSCeh25293

Uninstalling CSA turns on Windows XP firewall automatically

Sympton:Windows XP SP2 offers firewall functionality to those who install Service pack 2. The firewall is disabled but after installing and uninstalling CSA the firewall is automatically turned on. The state of the firewall should be the same as before you installed the agent.

Workaround: After CSA uninstall completes, set the Windows Firewall to the appropriate state manually.

CSCeh29382

An agent running on Windows NT is unable to resolve MC hostname after upgrade.

Symptom:If DNS is not configured properly and the agent is installed on a Windows NT machine, the agent may not be able to resolve CSA MC properly. We require that CSA MC be resolvable via DNS or WINS but in some cases, the NT 6a system tries to resolved via netbios.

Workaround:Make sure DNS is properly configured and the machine name of CSA MC can be resolved via DNS.

CSCeh31986

The Behavior analysis progress status for log file size does not work on Solaris.

Symptom:While your Application behavior analysis is in-progress, the progress status for log file size resets to zero. This happened to both Unix platforms (Solaris and Linux).

Workaround:If your Application behavior analysis relies on log size as a criteria, there is no status available. Using other criteria, such as number of invocations, will provide progress status.

CSCeh32788

Intermittently, logout and reboot causes a 30 second to 2 minute hang.

Symptom:An attempt to logout and restart the Linux machine will often result in a hang.

Workaround:None at this time. It is best to wait for the system to recover to maintain system integrity.

CSCeh34232

Install as power user on W2k3 provides no failure feedback to user.

Symptom:When a non-administrator attempts to install a Cisco Security Agent kit, the installation will fail because administrator permissions are required. Agent kits can be created in silent or interactive modes. When an silent agent kit is installed by a non-administrator, it is silent and does not provide feedback to the screen.

Workaround:Inspect the installation log created by the agent kit installer.

CSCeh35116

Microsoft AntiSpyware questions the CTA installer.



CSCeh35360

Network access control rules trigger incorrectly with alias IP address & same netmask.

Symptom:Network access control rules trigger incorrectly with alias IP addresses and similar netmask addresses(UNIX) in the presence of a Network access control rule specified to control connections on one of these local addresses. The agent may trigger an incorrect Network access control rule or no rule at all. This is because the TCP/IP layer doesn't report the local IP address on which the packet was received and the agent attempts to select a correct local IP address that matches the address specified in the rule. The agent selection logic may return an incorrect local IP address and thus apply a wrong rule or no rule at all.

Workaround:None at this time.

CSCeh35616

An incorrect Network access control rule triggers when packets are sent to an alias IP address.