**********************************************************************
Symantec Network Security 7100 Series Engine Update 3       Readme.txt
Copyright (c) 2005 Symantec Corporation                   January 2005
**********************************************************************


The following is a Readme for Symantec Network Security 7100 Series 
appliance Engine Update 3.  

This Engine Update applies to all models of the Symantec Network 
Security 7100 Series appliances. 

For additional information, contact technical support or consult the 
knowledge base via the Symantec Web site at: 

* Technical support:
  http://www.symantec.com/techsupp/enterprise/custserv/contact_cs_online.html
  http://www.symantec.com/techsupp/enterprise/custserv/contact_cs_phone.html
  
* Knowledge base:
  http://www.symantec.com/techsupp/enterprise/select_product_kb.html
  
  - Click Intrusion Protection > Symantec Network Security > 
    Symantec Network Security 7100 Series


This Readme discusses the following:

* Engine Update solutions
* Signature engine enhancements
* Possible core dump issue resolution
* Event description enhancement
* False positive enhancement
* Engine Update impact
* Installing Engine Update 3


Engine Update solutions
-----------------------
Engine Update 3 provides solutions for the following:

* Portmap merge script
* Common buffer memory leaks
* UDP streams on signature set reload


Signature engine enhancements
-----------------------------
This Engine Update contains enhancements of the Symantec 
Network Security Signature Language, which includes conditional and 
unconditional jump statements. 


Possible core dump issue resolution
-----------------------------------
Symantec Network Security incorrectly accounts for entries in fixed 
sized tables, which may lead to a core dump. This core dump should 
only occur rarely and results in a brief loss of detection coverage as 
the sensor automatically restarts. Engine Update 3 resolves this 
issue.


Event description enhancement
-----------------------------
The following event description change is incorporated into Engine 
Update 3:

* Added Mismatch TCP Checksum known triggers


False positive enhancement
--------------------------
Engine Update 3 provides solutions for the following false positive 
alert:

* Malformed HTTP Header Value with empty "Server:" line


Engine Update impact
--------------------
Installing Engine Update 3 restarts the 7100 Series appliance sensors.
For any 7100 Series appliance running in inline, this process causes a 
brief network interruption.


Installing Engine Update 3
--------------------------
Engine Update 3 is automatically installed on the Symantec Network 
Security 7100 Series appliance via the Symantec LiveUpdate service.