Endpoint Protection

Hello

Today many users reported problem with Firefox browse . During test we find out that after downloading now update (from 12.09.2016) Firefox wans't opening .

After implementing virus definition from yesterday , firefox work fine again .

Server reboot didn't solve issue nor re-installation of Firefox .

Other browsers work fine

What should be done in such situation?

did anyone experience it in past ?

if its observed across your network especially after the yesterday's definition, its likely that its a global issue. Might be symantec is already aware of this and working on fixed definition already. But to be sure I would suggest you to create a support case and let them know and try to get the official information from their end and probable fix ETA.

You can rollback your definitions to a working set. Also, make sure you contact support.

How to Backdate Virus Definitions in Symantec Endpoint Protection Manager

Hello. 

Same problem with Firefox 38.8  and SEP 12.1.6 RU5.  

In our enviroment, some computers have updated Firefox to newest version and works ok.

We have forced IPS signatures to 09/09/2016 version and seems to be temporal solution.  Computers seems work ok with this version.

Regards.

Also, the latest virus definitions are 9/13/16 r1. Has anyone tried with this set?

How Long it will take to Fix the issue with the latest IPS definition version

Thanks,

Balaji Krishnan

hello.

Thank you . Changing of IPS policy solve this issue.

Time depend from how many endpoints there are in console . I just leave it and wait for automated update .

Have you opened a case with Symantec to verify they're aware of the issue?

Has anyone?

We have customers with the same problem.

In our case it seems that the client intrusion prevention signatures stop FF from running.

Signatures from 9.9.2016 seem to work.

Hello Brain,

thanks for the reply, Yes I do have opened a case with Symantec. Case number 

Same issue here and also the latest defs are affected (9/13/16 r1). We use Firefox 38 ESR.

I backdated the definitions, however I may have been too late. Everyone has 9/13 R1, when I do a live update from the user or "Update Content" from server, they do not automatically roll back.

I think in the past I needed a 3rd party tool to get them to "Live Update" to a previous version. The computers that have FFE 38 are extremely locked down and I expect this not to work for me.

My only hope is the latest defs fix the issue. We do not use a live update server, so even if I can not even push a pre-production update from an inhouse server (I was able to do this with Altiris in the past).

I'd like to know this as well. Rolling Back to 9/9 IPS fixed us temporarily, but we would like an update to resolve issue.

Thanks!

After rolling back the definitions to yesterday, clients finally updated, however the problem still existed.

I then rolled them back to 9/09 definitions and the Proactive and Network Threat went blank and stated they were waiting for an update. I will test this further - however it would be a lot easier if the latest defs work with this old version of FireFox ESR 38.8 (FYI 38.2 seems to work).

Greetings,

We have published updated IPS content to resolve the issue. Please run LiveUpdate to update to the below IPS content revisions or greater.

12.1 RTM->12.1 RU1 MP1: 160912003 (September 12th, 2016 rev. 3)

12.1 RU2+: 160912013 (September 12th, 2016 rev. 13)

Thanks!

All good this morning since the latest definition update.

Hello all,

Here is the official article on the issue:

Firefox crashing with IPS defs 9/12/2016 rev. 11
http://www.symantec.com/docs/TECH235780
 

@Mick2009,

The article you are linking to does not appear to be live yet.  I receive a "Didn't find the article you where looking for?" response page.

Thanks.

It's live for me. It takes some time to replicate to all Symantec servers worldwide so this could be the hold up.

@Brian,

Thanks for the followup.  I will check the link again shortly.

Definitely appears for me.  &: )

https://support.symantec.com/en_US/article.TECH235780.html?

@Brian, @Mick2009,

I am now able to access to tech doc.  Thanks for checking.