McAfee^® Email Gateway 7.0h759601

Release Notes for McAfee^® Email Gateway

Version 7.0

Hotfix 7.0h759601

About this release

Thank you for using our software. This file contains important information about this release. We strongly recommend that you read the entire document.

Purpose

This release addresses the issues shown in the Resolved issues section below.

Packaging

This release is available in the form of:

an incremental update package
a set of installable images

Rating

This release addresses critical issues. McAfee strongly recommends implementing this release at your earliest opportunity.

Severity of issues listed below is based on these definitions:

High: a critical issue which should be addressed as soon as possible, if necessary outside a planned maintenance schedule.
Medium: an issue which should be addressed at the earliest opportunity, normally as part of a planned maintenance schedule.
Low: a non-critical issue, advisable to address as part of planned maintenance.

Resolved issues

Vulnerabilities (total: 2, new: 1)

Vulnerabilities newly addressed in this release:

f_759607

Vulnerability fixes included from previous releases:

f_753669

High severity issues (total: 1, new: 1)

High severity issues newly addressed in this release:

f_759607

Medium severity issues (total: 1, new: 0)

Medium severity fixes included from previous releases:

f_753669

Issues list

Feature f_759607

Description:
Multiple security vulnerabilities in the appliance user interface were resolved, including a bypass of authentication controls.
Please refer to KnowledgeBase article KB75077 for more information.
Severity: High

Feature f_753669

Description:
ISSUE: Vulnerability CVE-2003-1418 was reported against the Apache version used by the appliance.
RESOLUTION: The Apache configuration used on the appliance has been updated to address the problem.
Please refer to KnowledgeBase article KB74962 for more information.
Previously addressed by 7.0h753669.
Severity: Medium

Issues resolved in previous releases

For information on issues resolved in earlier releases not included above, consult their release notes:

Patch 7.0.1 (see KnowledgeBase article KB74045)

Additional information

This release was built on 2012-04-20.

This release was tested with anti-virus engine version 5400, DATs version 6615 and later. McAfee strongly recommends that the appliance is always kept up to date with the latest anti-virus components to achieve the highest possible security.

Incremental update package

The incremental update package may be installed on a running appliance with the least possible disruption of service.

In due course this package, or one superseding it, will be made available for download and install with the appliance auto-update system. For information on using auto-update refer to KnowledgeBase article KB74923.

Installation requirements

You must have the following McAfee Email Gateway software installed on the appliance you intend to update with this package:

Version 7.0
Patch 7.0.1

Superseded releases

This package incorporates and supersedes the following earlier releases:

Hotfix 7.0h753669

Actions on installation

At the end of the installation process the following actions will occur automatically:

The user interface will log off.
Selected system services will restart, depending on the appliance configuration.

Files included with this package

This package consists of archive file called MEG-7.0h759601-2151.119.zip, which contains the following files:

7.0h759601-2151.119/rpms/webshield-UI_backend-9.0-201202182000_117.i386.rpm
7.0h759601-2151.119/rpms/webshield-WebMailClient-9.0-201202182000_119.i386.rpm
7.0h759601-2151.119/rpms/webshield-files-9.0-201202182000_110.i386.rpm
7.0h759601-2151.119/rpms/webshield-ui-9.0-201202182000_109.i386.rpm
7.0h759601-2151.119/updata/package.xml
validate/filelist.txt
validate/md5sum.txt
validate/version

Installation steps

In the case of a virtual appliance it may be useful to take a snapshot of the appliance before installing the package.

To install this package:

Create a temporary directory on your hard disk, and download the zip file provided by McAfee to a computer on your network that can access the McAfee Email Gateway appliance.
Open your Internet browser, and browse to the McAfee Email Gateway appliance.

If installing on a Content Security Blade Server, go first to the Failover Management blade to do the following steps, then repeat them on the Management blade (the content scanning blades will be updated automatically).

If installing on an appliance cluster the steps must be done on all the appliances in the cluster, starting with the Failover Management appliance, then the Management appliance, then the remainder.

When prompted, log on to the appliance by typing your username and password.
On the navigation bar, select System | Component Management | Package Installer.
Under Manual Package Install, click Update from file. In the Import package window, click Browse, find the location of the file "MEG-7.0h759601-2151.119.zip", click Open, and then click OK.

A popup window appears displaying the package description and a notice that the appliance will restart after installation. Click OK to install the package.

Upon completion of the installation the actions noted above will be performed automatically.

Clear the browser cache before logging on to the interface again. If the browser cache is not cleared, the interface will not behave correctly.
After installation, log on to the user interface and click About the appliance to check that "7.0h759601-2151.119" is displayed.

After installation

If you plan to use the MEG-7.0h759601-2151.119.zip archive file again, keep it available on your computer. Otherwise, delete the file after successful installation. If you re-install your McAfee Email Gateway version 7.0 software, we recommend that you re-install this release.

Removing this package

To remove this package from your McAfee Email Gateway appliance, you need to reinstall McAfee Email Gateway version 7.0. An alternative, for a virtual appliance, is to revert to a previous snapshot. Please note that all other hotfixes or patches installed on the appliance would also be removed in the process.

Installable images

Installable images are available for the various types of appliance. For information on installing these images refer to KnowledgeBase article KB71956.

When using this method to upgrade an existing appliance, there is an option to install software while retaining the existing operational data (option 2 on the install menu). This option is available where one of the following compatible versions is already installed:

This release or any superseded releases, but not any later release other than hotfixes
Version 5.6 with 5.6p1 or later releases

Superseded releases

This package incorporates and supersedes the following earlier releases:

Version 7.0
Patch 7.0.1
Hotfix 7.0h753669
Hotfix 7.0h758342

Notices

Important information

The attached files are provided as is, and with no warranty either expressed or implied as to their suitability for any particular use or purpose. McAfee, Inc. assumes no liability for damages incurred either directly or indirectly as a result of the use of these files, including but not limited to the loss or damage of data or systems, loss of business or revenue, or incidental damages arising from their use. Hotfix files should be applied only on the advice of McAfee Technical Support, and only when you are actually experiencing the issue being addressed by the hotfix. Hotfix files should not be proactively applied in order to prevent potential product issues. You are responsible for reading and following all instructions for preparation, configuration, and installation of hotfix files. Hotfix files are not a substitute or replacement for product Service Packs which may be released by McAfee, Inc. It is a violation of your software license agreement to distribute or share these files with any other person or entity without written permission from McAfee, Inc. Further, posting of McAfee hotfix files to publicly available Internet sites is prohibited. McAfee, Inc. reserves the right to refuse distribution of hotfix files to any company or person guilty of unlawful distribution of McAfee software products. Questions or issues with McAfee hotfix files should be directed to McAfee Technical Support.

Copyright

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

Trademark attributions

AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners.

License information

License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.