SymWise Document ID | TITLE |
TECH170752 | Download SymDiag to detect Symantec product issues |
TECH103088 | Download the latest version of Symantec Endpoint Protection |
TECH184988 | Uninstall Symantec Endpoint Protection |
TECH122466 | Virus removal and troubleshooting on a network |
TECH160736 | Disaster recovery best practices for Symantec Endpoint Protection 12.1 |
TECH102467 | Update virus definitions and content for Endpoint Protection |
TECH123686 | How to install the certificate for the Endpoint Protection Manager web console access |
TECH160964 | Troubleshoot communication issues with Endpoint Protection Manager 12.1 |
TECH102607 | Download .jdb files to update definitions for Endpoint Protection Manager |
TECH163707 | Installation and Migration Documents for Symantec Endpoint Protection 12.1 |
HOWTO55056 | Licensing Symantec Endpoint Protection |
HOWTO55294 | Activating your new or renewed Symantec Endpoint Protection 12.1 product license |
TECH95347 | Best practices regarding Intrusion Prevention System technology |
HOWTO55112 | Downloading a license file for a new or renewed license, or a license upgrade |
TECH163700 | Best practices for upgrading to the latest version of Endpoint Protection 12.1.x |
TECH103087 | New features and fixes for Symantec Endpoint Protection 11 |
DOC4332 | Release Notes for Symantec Endpoint Protection, Symantec Endpoint Protection Small Business Edition, Symantec Network Access Control 12.1 |
TECH187658 | Symantec Endpoint Protection 12.1 RU1 MP1 Client-only patch |
TECH102822 | How to block a user's ability to disable Symantec Endpoint Protection on Clients |
TECH195325 | System requirements for Endpoint Protection 12.1.2 and 12.1.3 |
Top 20 SymWise articles for SEP - Updated September 2016
SYM16-010 - Symantec Decomposer Engine Multiple Parsing Vulnerabilities
Parsing of maliciously-formatted container files may cause memory corruption, integer overflow or buffer overflow in Symantec's Decomposer engine. Successful exploitation of these vulnerabilities typically results in an application-level denial of service but could result in arbitrary code execution. An attacker could potentially run arbitrary code by sending a specially crafted file to a user.
For more information about SYM16-010, see Symantec Decomposer Engine Multiple Parsing Vulnerabilities on the Security Response website.
Affected Products
- Advanced Threat Protection (ATP)
- CSAPI
- Email Security Server .Cloud (ESS)
- Symantec Data Center Security:Server (SDCS:S)
- Symantec Endpoint Protection (SEP)
- Symantec Endpoint Protection for Linux (SEP for Linux)
- Symantec Endpoint Protection for Mac (SEP for Mac)
- Symantec Endpoint Protection Small Business Edition (SEP SBE)
- Symantec Mail Security for Domino (SMSDOM)
- Symantec Mail Security for Microsoft Exchange (SMSMSE)
- Symantec Message Gateway (SMG)
- Symantec Message Gateway for Service Providers (SMG-SP)
- Symantec Protection Engine (SPE)
- Symantec Protection for SharePoint Servers (SPSS)
- Symantec Web Gateway
- Symantec Web Security .Cloud
For more information see article ALERT2047 as well as related articles.
SEP 12.1 RU6 MP5 Wont liveupdate on windows 10
Hello..
A newly installed SEP 12.1 client installed via a Setup "package" wont live update whilst connecting to successfully to live update server.
Attached screenshot showing the failed messages relating to each type of File.
For example "encountered an error while downloading file sepc$20cids$20signatures..........."
Any ideas ?
Thanks
Latest SymWise Articles & Alerts for ATP - September 2016
SymWise Document ID | TITLE |
TECH89724 | Support Statement for Symantec Messaging, Web, and ATP Security Appliances |
TECH203650 | How to collect a DSET report for a Symantec Security appliance |
GUIDES10039 | "Connection Error" on status of SEPM Connection |
TECH204439 | What is a "Manually Generated Anomaly"? |
TECH228733 | Suspected false positive detection within SATP:N appliance |
Symantec Connect Blog | New Symantec Email Quarantine for Email Security.cloud |
TECH226881 | Schemus LDAP Synchronization Tool.cloud log and configuration file location |
HOWTO101610 | AntiSpam best practice settings |
ALERT2047 | SYM16-010 - Symantec Decomposer Engine Multiple Parsing Vulnerabilities |
ALERT2036 | Late Breaking News and Release Notes for Advanced Threat Protection (ATP) Platform 2.0.3 |
ALERT2021 | Advanced Threat Protection Platform software update servers certificates moving to SHA-2 |
ALERT1943 | Late Breaking News and Release Notes for Advanced Threat Protection (ATP) Platform 2.0 |
What version of SEP can support MacOS Sierra ?
Please advise what version of SEP can support MacOS Sierra ? Is there any location to download for test? Thanks
Firefox problem after SEP update
Hello
Today many users reported problem with Firefox browse . During test we find out that after downloading now update (from 12.09.2016) Firefox wans't opening .
After implementing virus definition from yesterday , firefox work fine again .
Server reboot didn't solve issue nor re-installation of Firefox .
Other browsers work fine
What should be done in such situation?
did anyone experience it in past ?
VIP 9.8 push authentication does not work with ADFS 3 for Office 365 integration
I have followed the Partner Integration for ADFS 3 guide to setup Office 365. I created the code on my VIP Manager to input into IAScript.js. Because I am not using out of band, the guide says I do not need to use the SSP information in this code. When I have completed the plugin install and configuration of the ADFS server I am able to login to the office 365 site and input my code that I have on my credential. Once I enable JS on the ADFS plugin configuration I receive an error that shows on the attached screenshot. I have made sure that IA is enabled on my VIP manager. Any ideas?
Thanks
VIP 9.8 OWA IIS integration for radius and Out of Band Authentication
We have gone through the Partner Integration Guide for IIS in order to implement OWA for Exchange 2010. Because our users are using the FQDN we cannot use Auth as Symantec strips the domain automatically. This means we have to use Radius with Security Code. We are able to make push authentication work but we cannot use OOB according to the guide. Has anyone found a way to make this work?
Thanks
Reputation Lookups in DCS:S
Hello
Could somebody confirm how reputation lookup work in policy AV Policy on DCS:S ?
During scanning for same executable file are query to Insight Cloud or definition contain some information on reputation. SVA don't send query about executable file.
Spam Submissions by uploading Mails to End User Quarantine
We are using Customer-Specific SPAM Submissions from a long time and administrators submit samples using control center. As per Symantec, these submissions only work if those are submitted within 24 hours of receipt. Most of the times it does not happen that way as users take more than 24 hrs time to report 'Missed SPAMs' to security team. Hence those submissions do not result in signature creation.
Moreover, Symantec does not support integration with email systems other than microsoft exchange, by which users could submit the mails at their own (Self Service).
We would like to suggest Symantec, to provide a functionality so that the users could upload the samples to their spam quarantine login and those samples get automatically submitted to Symantec.
We would like to request other community members to vote for it as it'll be very useful feature for all of us. And Symantec must consider for a future release.
compatibility between pgp and endpoint encryption
At the company where i work, PGP 10.2/10.3 is the official file encryption program all users have access to. But now that it is no longer available to buy, the question has been raised about the compatibility between pgp and endpoint encryption.
If an emplyee encrypt a file in PGP and sends it to a partner that has endpoint encryption. Will it work, can the person at the partner company open the file, using keys, just like in PGP to PGP transfers?
Web Prevent Configuration - Bluecoat DLP 14
Dear,
I have this questions with the web prevent (DLP 14) and the "Maximum Number of Requests" and "Maximum Number of Responses" configuration.
In this scenario 3500 employees using internet via Bluecoat and reference to this two guides i have some doubt.
https://support.symantec.com/en_US/article.DOC8236...
https://support.symantec.com/en_US/article.TECH219...
The actual configuration is:
BoxMonitor.FileReaderMemory
-Xrs -Xms1200M -Xmx4G -XX:PermSize=128M -XX:MaxPermSize=256M
Maximum Number of Responses 256
MessageChain.CacheSize 256
and the recomendation is:
-Xrs –Xms2048M –Xmx16384M
This value mabe cause a slow access to internet page?
Other dout is reference to the hardware for web prevent , the server has 2 2.4 GHz processors four core each with 16 GB of ram , according this guides the hard is correct
Its possible to setting in web prevent the number of 3500 for Maximum Number and Requests and Maximum Number of Responses with this hardware?
SEP causes Firefox to crash
Hello,
This morning we have been getting reports from within our environment where if workstations have Firefox Version 39, SEP seems to cause it to crash. If we uninstall SEP, firefox works fine. Has anyone heard anything about this? Please refer to the link below
https://support.mozilla.org/en-US/questions/1138687
Update Content
Quick question what does it mean when you right click on a SEPM group and choose update content? I just want to understand what happens when you do that? Does it only download policies? latest definations? if so from where, GUP? SEPM Or internet?
How to Scan my Android Mobile
I am faceing problem in symantec client, how to scan my Android mobile, because scan option is not available when i connect it with my Desktop, so request to please give me solution regarding this issue.
Active Directory scanning
According to KB article Active Directory exclusions are automatically added if the SEP client detects that the server is a DC ; BUT
Exclusions are not added if the server is promoted to a DC therefore the client has to be reinstalled or added manually. What are my options in regards to registry exclusions?
Referenced Articles:
https://www.symantec.com/connect/forums/automatic-...
https://support.microsoft.com/en-in/kb/822158
How to enable disabled endpoint client from management console
Hi..
I have 4 endpoint client has disabled ,other all othe user are restricted from disable endpoint .How to enable the 4 endpoint client from management console.
Full Scan Duration Calculator
Hi all
Please see full scan configuration below, tuning: best scan performance
we are having an issue because most of the workstations is unable to finish the scan, is there an event viewer like or report that can show the reason why the scan was suspended?
also is there a calculator like that can compute the scan duration (even just estimation) of full scan if the:
CPU core is:
RAM is:
Hard disk is:
Free space is:
then the scan duration is = ???
Before, most of the user of our customer is complaining that their workstations is slowing down because of the scheduled scan at 4pm so we set this up at 8pm office hours is done (the users are all morning shift)
i suspect that having 12 hours scan duration duration is not enough for other workstations with low specs or capacity, i want to get back to our customer that i can show to them their low specs workstations and their users whos maybe turning off the workstations are the reason why the full scan was never completed
i hope someone can help
Thank you in advanced
Winston VP
Live Update Administrator
Hi,
I know that this problem is not the SEP problem but this is related to SEP. I need to download new version of Live Update Administrator from https://support.symantec.com/en_US/article.TECH134809.html
But link doesn't work. I get message:
An error occurred while processing your request.
Reference #50.c44a1502.1473844824.20c251ae
Maybe, there is an another location of install files ?
Regards.
Sebastian
Virus cleaning on SMG
Hi,
Malware policies has a policy which says:
virus: clean message
What happens when the "cleaning" fails? Is the message delivered to the user?
We had this policy activated, and all trojan infected .doc files would get past it to the users!
Then there's another policy:
virus: quarantine
The TAC kept telling me that either cleaning OR quarantine can be used but both can't be done at once. In this policy I have added 2 actions now: clean the message and hold in spam. Why did the policy accept both those actions if it can't be done?
At least now with the second policy I can see a trojan verdict and the emails are being held in spam as per the msg audit logs.