Patch Assessment Content Update Release Notes for CCS Version: Update

(1)

Patch Assessment Content

Update Release Notes for

CCS 11.1

(2)

Patch Assessment Content Update 2015-10 Release

Notes for CCS 11.1

Legal Notice

Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

This Symantec product may contain third party software for which Symantec is required to provide attribution to the third party (“Third Party Programs”). Some of the Third Party Programs are available under open source or free software licenses. The License Agreement accompanying the Software does not alter any rights or obligations you may have under those open source or free software licenses. Please see the Third Party Legal Notice Appendix to this Documentation or TPIP ReadMe File accompanying this Symantec product for more information on the Third Party Programs.

The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any.

THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.

(3)

Symantec Corporation 350 Ellis Street

Mountain View, CA 94043

(4)

Patch Assessment Content

Update (PACU)

This document includes the following topics:

■ Prerequisites for PACU

■ What's New in PACU 2015-10

■ Patch Assessment Content Updates for Windows in 2015-10

■ Patch Assessment Content Updates for UNIX in 2015-10

■ Updates in PACU 2015-9

■ Contents of the PACU

Prerequisites for PACU

The following are the prerequisites for installing the Patch Assessment Content Updates:

■ Before you install a Patch Assessment Content Update, you must have the

Control Compliance Suite 11.1 or later versions installed on your computer.

■ To install PACU 2015-4 or later by using the LiveUpdate feature, you must apply the Quick Fix 10005.

A new signing certificate is used for all CCS files that are signed after February 12, 2015. The Quick Fix 10005 includes the Symantec.CSM.AssemblyVerifier.dll, which contains the updated CCS certificate information necessary to validate the certificate.

You can download the Quick Fix 10005 from the following location:

(5)

Note:If the Quick Fix 10005 is not applied, the Automatic Updates Installation job will fail. However, there is no impact on the manual installation of PACU without this Quick Fix.

■ To manually install PACU 2015-4 or later, on CCS 11.1 on Windows 2003 Server successfully, you must deploy a Microsoft hotfix.

If the hotfix is not applied, the manual installation fails and the digital certificate validation error message is displayed.

You must request for this hotfix via the Hotfix Download Available link at the following location:

http://support.microsoft.com/kb/968730

What's New in PACU 2015-10

PACU 2015-10 contains the following updates:

■ Patch Assessment Content Updates for Windows in 2015-10

See“Patch Assessment Content Updates for Windows in 2015-10”on page 5.

■ Patch Assessment Content Updates for UNIX in 2015-10

See“Patch Assessment Content Updates for UNIX in 2015-10”on page 6. PACU 2015-10 includes the updates from PACU 2015-9.

Patch Assessment Content Updates for Windows in

2015-10

PACU 2015-10 contains checks for updates released by Microsoft in May 2015 on raw-data content.

Updates for raw-data content

■ MS15-043

Cumulative Security Update for Internet Explorer (3049563)

■ MS15-044

Vulnerabilities in Microsoft Font Drivers Could Allow Remote Code Execution (3057110)

■ MS15-045

Vulnerability in Windows Journal Could Allow Remote Code Execution (3046002)

■ MS15-046

5 Patch Assessment Content Update (PACU)

(6)

Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3057181)

■ MS15-047

Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (3058083)

■ MS15-048

Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (3057134)

■ MS15-049

Vulnerability in Silverlight Could Allow Elevation of Privilege (3058985)

■ MS15-050

Vulnerability in Service Control Manager Could Allow Elevation of Privilege (3055642)

■ MS15-051

Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (3057191)

■ MS15-052

Vulnerability in Windows Kernel Could Allow Security Feature Bypass (3050514)

■ MS15-053

Vulnerabilities in JScript and VBScript Scripting Engines Could Allow Security Feature Bypass (3057263)

■ MS15-054

Vulnerability in Microsoft Management Console File Format Could Allow Denial of Service (3051768)

■ MS15-055

Vulnerability in Schannel Could Allow Information Disclosure (3061518)

Patch Assessment Content Updates for UNIX in

2015-10

There are a total of 150 updated patches and 541 new patches in dat (template) files for the following platforms:

Updates for raw-data content

■ Sun Solaris

■ Linux

■ Ubuntu

(7)

■ HP-UX

Updates in PACU 2015-9

The PACU 2015-9 contained the following updates:

Patch Assessment Content Updates for Windows in 2015-9

PACU 2015-9 contains checks for updates released by Microsoft in April 2015 on message-based content.

Updates for message-based content

■ MS15-032

Cumulative Security Update for Internet Explorer (3038314)

■ MS15-034

Vulnerability in HTTP.sys Could Allow Remote Code Execution (3042553)

■ MS15-035

Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution (3046306)

■ MS15-036

Vulnerabilities in Microsoft SharePoint Server Could Allow Elevation of Privilege (3052044)

■ MS15-037

Vulnerability in Windows Task Scheduler Could Allow Elevation of Privilege (3046269)

■ MS15-038

Vulnerabilities in Microsoft Windows Could Allow Elevation of Privilege (3049576)

■ MS15-039

Vulnerability in XML Core Services Could Allow Security Feature Bypass (3046482)

■ MS15-040

Vulnerability in Active Directory Federation Services Could Allow Information Disclosure (3045711)

■ MS15-041

Vulnerability in .NET Framework Could Allow Information Disclosure (3048010)

■ MS15-042

Vulnerability in Windows Hyper-V Could Allow Denial of Service (3047234)

(8)

Patch Assessment Content Updates for UNIX in 2015-9

PACU 2015-9 updates the UNIX operating system and application patches for message-based content.

Updates for message-based content in Patch Policy

■ HP-UX

■ Oracle Enterprise Linux (OEL)

■ Red Hat Enterprise Linux (RHEL)

■ Solaris ■ SUSE

Comprehensive standard for Windows and UNIX on message-based

content

PACU 2015-9 contains the comprehensive standard for the patch policy.

Table 1-1 Message-based data content patch policy and standard updates for Windows and UNIX

OS Patch Policy Version Standard Version

File Name

2015.04.01 1.1.56

ESM_OSPatches_Comprehensive.xml

Contents of the PACU

PACU contains the following files: Table 1-2 Contents of the PACU

Description Name

Raw-data content standard for Windows SEForMSPatches_Comprehensive.xml

Raw-data content standard for Windows SEForMSPatches_Less.xml

Raw-data content updates for Linux platforms

LinuxRecommendedPatches.dat

Raw-data content updates for HP-UX platforms

HP-UXRecommendedPatches.dat

(9)

Table 1-2 Contents of the PACU (continued) Description Name

Raw-data content updates for AIX platforms

AIXRecommendedPatches.dat

Raw-data content updates for Sun OS platforms

SunOSRecommendedPatches.dat

Message-based content updates for Windows and UNIX

ESM_OSPatches_Comprehensive.xml

Raw-data content file for Windows data collection

bvMSSecure.xml

Raw-data content file for Windows data collection

hf7b.xml

Patch Policy updates on message-based content for Windows and UNIX. BestPractice_OS_Patch_Updates.exe

Contains checks which evaluate on APAR and Packages for AIX OS Comprehensive_AIXPatchStandard.xml

Custom algorithm used for evaluating package checks in the Comprehensive Patch Standard for AIX.

Symantec.CSM.

UnixPlatformContent.UnixPatchStandard.dll Version 11.10.10000.1160