PB#1078: TippingPoint SMS v5.0.0 customers

Product Bulletin #: 1078

Subject: TippingPoint SMS v5.0.0 customers

Affected Devices and TOS versions:

• All S-series (S10, S110, S330) with all TOS versions
• All N-series (660N, 1400N, 2500N, 5100N, 6100N) with all TOS versions
• All NX devices (2600NX, 5200NX, 8200NX, 7100NX, 7500NX) with all TOS versions

Devices Not Impacted: vTPS, 440T, 2200T, 8200TX, 8400TX & all NGFW models

Date of Announcement: April 24, 2018

Summary: SMS v5.0.0-106258 has been removed from the Threat Management Center (TMC) due to a critical issue pertaining to the distribution of profiles to S-Series, N-Series and NX-Series devices. This issue can cause some filters that have filter overrides applied to revert back to Category Settings following a profile push, such as filters previously disabled becoming re-enabled. This issue does not apply to TPS (T-Series or TX-Series devices) or Next Generation Firewall devices.

Trend Micro TippingPoint has released a hotfix, Trend Micro TippingPoint SMS v5.0.0 Hotfix 123030a, to address this issue. The hotfix can also be obtained by contacting the TippingPoint Technical Assistance Center (TAC). SMS 5.0.0 (Patch 2) must be installed prior to applying the hotfix. Installation of this hotfix is strongly recommended by Trend Micro before distributing another profile to any device to prevent any further filter override discrepancies.

This issue occurs when all of the following conditions are met:

1. Two or more filters have overrides applied.
2. One or more of the overridden filters is removed from the next activated DV (including Malware or DVToolkit)
3. A profile push occurs after the DV is activated.

If these conditions occur, filters with overrides can revert to Category Settings on the IPS devices to which the profile distribution is targeted. Applying the SMS hotfix will prevent this issue from re-occurring, however, a reboot of the affected IPS and re-distribution of all profiles is required to remove it from the failed state.

To correct this issue, users must perform the following steps in the prescribed order:

1. Apply SMS v5.0.0 Patch 2
2. Apply SMS v5.0.0 hotfix version 123030a
3. Reboot all IPS devices that meet the Affected Devices criteria listed above
4. Re-distribute all profiles to their appropriate segments

Link to Patch 2 on TMC: https://tmc.tippingpoint.com/TMC/ViewPackage?parentFolderId=sms_update_packs&contentId=SMS_Patch_5.0.0.106258.2.pkg

Link to hotfix on TMC: https://tmc.tippingpoint.com/TMC/ViewPackage?parentFolderId=hotfix&contentId=hotfix_123030a_5.0.0.106258.p2.717.sign.pkg

To install the hotfix on SMS running version v5.0.0 Patch 2, complete the following steps:

1. On the SMS menu select Tools > Diagnostics > Hotfixes.
2. Click Install to install a single SMS software hotfix.
3. Click Install Bulk > Add to batch install multiple software hotfixes

Customers can obtain SMS v5.0.0 by contacting the Trend Micro™ TippingPoint Technical Assistance Center (TAC). A member of TAC can assist with upgrading to SMS v5.0.0, applying Patch 2 and the hotfix to avoid this issue.

If you have concerns or further questions regarding this issue, contact the Trend Micro TippingPoint Technical Assistance Center (TAC).

Thank you,
Trend Micro™ TippingPoint

For updated contact information, please click here.

 

© Copyright 2018 Trend Micro Incorporated. All rights reserved. Trend Micro, the Trend Micro logo, TippingPoint, the TippingPoint logo, and Digital Vaccine are trademarks or registered trademarks of Trend Micro Incorporated. TippingPoint Reg. U.S. Pat. & Tm. Off. The information is provided "as is" without warranty of any kind and is subject to change without notice. The only warranties for Trend Micro products and services are set forth in the express warranty statements accompanying such products and services. nothing herein should be construed as constituting an additional warranty. Trend Micro shall not be liable for technical or editorial errors or omissions contained herein.