Update 28-FEB-2010

Previously Symantec communicated that 2009 dated definition content would no longer be available as of Sunday, February 28th.  Due to a minority of customers still relying on these definitions, a decision has been made to continue posting these definitions three times per week until Saturday, March 13th.  After this date no new 2009 definition content will be made available. 

It is imperative that customers still deploying 2009 dated definitions make plans to immediately apply the patch to avoid leaving systems in an unprotected state.  Customers running Symantec Endpoint Protection should confirm that all SEPMs are patched, either automatically via LiveUpdate or manually in order to continue to receive current definition content. 

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Update 16-JAN-2010

The SEPM patch for the RTM, MR1, MR1MP1, MR2, MR2MP1, and MR2MP2. have been posted to the LU servers. WIth this update all GA versions of SEP that have been released since September 2008 have a patch available for them. That list includes the following versions:

---------------------------------------------------------------------------------------------------------------------------------

For those who have SEPM's which do not have access to LiveUpdate the manual fix tool is also available for download from the KB referenced. If you need instructions view this video highlighting the manual patch. https://www-secure.symantec.com/connect/downloads/sepm-patch-definition-issue -

Please refer to the following KB document for details regarding this issue if you need to download the manual patch.

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010010308571348

http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010010308571348

***** In particular, if you use LiveUpdate Administrator and the following critieria are true:

1. The SEPM is configured to download updates through LUA instead of Public LiveUpdate
2. SEP Clients are configured to download updates from their SEPM.

then please ensure you read the following KB: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010010901022848

-----------------------------------------------------------------------------------------------------------------------------------------------------

An issue has been identified in the Symantec Endpoint Protection Manager (SEPM) server whereby all types of SEP definition content [AV/AS, IPS] with a date greater than December 31, 2009 11:59pm are considered to be “out of date”.

1. The SEPM is configured to download updates through LUA instead of Public LiveUpdate
2. SEP Clients are configured to download updates from their SEPM.

Then PLEASE ensure you read the following KB: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010010901022848

Customers running SEP are still protected, and we are continuing to release updated definitions as normal.  However, for the time being, SEP definitions will display a date of December 31, 2009, with increasing revision numbers.

        View Inline Image

         View Inline Image

Symantec is working on a solution and will update customers when a solution becomes available.

IMPORTANT: This issue does not impact any other enterprise products (e.g. SAV or SCS) or consumer products.

For further information please see Symantec KB:
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010010308571348

Impacted Products:

• Symantec Endpoint Protection v11.x Product Line
• Symantec Endpoint Protection Small Business Edition v12.x Product Line

For those customers also running NAC who have Host Integrity configured to check their clients definitions, this issue will cause the HI check to fail.  The following options are available to you:
 

• To more accurately, for now, report on SEP clients that are genuinely behind on AV/AS defs, statically set the min allowed def date to be 30/12, so anything older than this fails HI.

         View Inline Image

• Disable the HI check on definition date

• For the specific AV/AS definition date check, you could temporarily check the box to “allow HI to pass even if it fails”, so you can still log and report centrally on HI results

        View Inline Image

This discussion will remain locked and serve as the official status post for this issue.  It will be updated by Symantec Employee's with the latest information.

If you wish to discuss the issue further, please use the following post: https://www-secure.symantec.com/connect/forums/sepm-update