Does Windows Update SHA2 problem affect SEP 12.1.x?

[WHairstonLOI]

I'm looking for clarification on exactly WHICH versions of SEP are causing issues with the August 2019 Windows updates which are only SHA2 signed.

The article at https://support.symantec.com/us/en/article.tech255857.html only mentions Symantec Endpoint Protection 14.2 RU1 MP1 as an affected product. Are other SEP versions also affected, or is it JUST this SPECIFIC version? Is this version mentioned only because it is the latest version?

We have several clients still running v12.1.6 RU9 and RU10 on Server 2008 R2 platforms and Windows 7 workstations - are these computers also affected? If so, will any patches be offered for those versions?

Thanks in advance for any insight!
Warren

[Rafeeq]

It says  "All symantec"

Microsoft and Symantec have identified an issue that occurs when a device is running any Symantec or Norton antivirus program and installs updates for Windows that are signed with SHA-2 certificates only. The Windows updates are blocked or deleted by the antivirus program during installation, which may then cause Windows to stop working or fail to start.

 

https://support.microsoft.com/en-in/help/4512486/windows-7-update-kb4512486

 

Applicable to Nortan as well

https://borncity.com/win/2019/08/14/symantec-norton-blocks-windows-updates-sha-2/

[WHairstonLOI]

@Rafeeq: Actually, that Microsoft article you referenced was the reason I was asking for clarification. Right beside the paragraph you quoted is the following paragraph:

Microsoft has temporarily placed a safeguard hold on devices with an affected version of Symantec Antivirus or Norton Antivirus installed to prevent them from receiving this type of Windows update until a solution is available. We recommend that you do not manually install affected updates until a solution is available.

The text "with an affected version" (highlighted emphasis mine) is what is confusing. What exactly are the affected versions? Is it every version produced to date, or are there only certain versions affected? I suspect it's every version currently available, but it would be helpful to have this point clarified.

I would also like to know if older versions such as 12.1.6 will be updated to address this issue, or if we must finally upgrade to v14.x.

Thanks for your response - I do appreciate the help!

[Rafeeq]

@WHairstonLOI,

have an another thread on this forum

https://www.symantec.com/connect/forums/issue-about-sha2-windows-update-situation?list_context_id=3377631&list_context_type=symantec_product

We do patch system using Landesk, we have Multiple customers , most of them have SEP installed. I have sent out an email to the customer's related to this issue, at this point we are making arrangements to have few versions tested by our team.

I'm sure that symantec would come strong on this.

[John Owens]

All versions of SEP 12.1 and 14.0 and 14.2 clients are affected.  Hotfixes are being made for SEP 14.2 RU1 MP1 and SEP 14.2 MP1.

 

[WHairstonLOI]

@John_Owens: Thanks for the update. I guess this means we're going to be forced into the v14.x upgrade sooner than we had planned.

Considering the "urgency" of these updates, is there an ETA on the hotfixes?

[cains]

He stated on another forum post that the ETA was 8/22.

 

[mwit]

Thanks for the update John, this has quite the impact.

[John Owens]

There has been no observed issue in relation to this update. Out of an abundance of caution we worked with MSFT to have the update hidden so that the potential for a False Positive could be prevented. The reason for this is that the version of SymVT that's in use with legacy Operating Systems (Win7/Win2K8R2) does not have the ability to see SHA-2 signatures.

By removing the signature from the evaluation process, there is the potential that the final reputation score is impacted which may result in Conviction/Exoneration variance. For this update, we observed no such False Positives.

However, it's possible a future update may have different behavior, so it's in everyone's best interest to pick up one of the fixed releases as soon as they're available so that this concern can be avoided.

That's why, for customers that have already taken the update (update isn't hidden for 3rd party deployment solutions) they can safely stay on it until we have the updated releases available.

[fian]

Hi John,

Will a hot fix be released for version 12.1?

[John Owens]

12.1 is end of support life. You should move to 14.2.

[Larry Hutto]

@John_Owens:  re: "Hotfixes are being made for SEP 14.2 RU1 MP1 and SEP 14.2 MP1."

Sorry if already asked answered but 2 questions:

1) what's the path forward if SEPM is on 14.2 RU1 (build 3335)?

2) Will you update this thread or start a new one when the 8/22 updates are available?

Thanks!

[Ravichandra Miyyapuram]

Any update on above asked questions?..even we are on 14.2 ru1 and we tested tha patches are not deleted by symantec but still want to be extra cautious

[John Owens]

I will post when 14.2 RU1 is available. Likley next week for that hoftix.

[Loyd Dyer]

If I am correct, SEP 14 cannot be installed on Windows Server 2008.  So the only solution for those servers is to replace them or do a clean wipe of symantec and use another product.

[Dejan Damjanovic]

Yes you can. The last version supported for Window server 2008 standard is 14.2.1031.0100 - 14.2 MP1 (refresh)

 Server 2008 R2 and above - Still in support with latest versions.

 

You can review all the versions here:

 

https://support.symantec.com/au/en/article.howto124730.html