SB10072 - Java issue with ePO that needs to be fixed

[pierce]

So just got the SNS with these details on:

https://kc.mcafee.com/corporate/index?page=content&id=SB10072

Looks like 5.1.1 is going to be out next month or there is a hotfix to patch java right now for eP 5.1.0 (and 4.6.7 and 4.5.7 and earlier).

I have downloaded the zip and it appears to just be an exe installer rather than having to replace any files.

(contents: 0x0409.ini , Data1.cab , ePOHF962156.exe , ePOHF962156.msi and setup.ini)

Anyone applied this yet? Whats risk like?

Will schedule mine for later next week as earliest time to install.

thanks,

Pierce

[PhilR]

It's installed painlessly here on our ePO 4.6.7 servers.

It only takes a few minutes to update.

Cheers,

Phil

[epriest]

I was a bit confused as the patch refers explicitly to version 4.6.7.  Yet it appears to fix 4.6.7 and EARLIER - we have 4.6.6.   Anyone tried the patch against 4.6.6 ?

Cheers

Eddie.

[pierce]

I think an upgrade and patch is needed, from the link:

Frequently Asked Questions (FAQs)

What is affected by this security vulnerability?

Affected Versions:

• ePO 4.5 Patch 7 and earlier
• ePO 4.6.7 and earlier
• ePO 5.1.0 and earlier

Protected Versions:

• ePO 4.6.7 with 32-bit hotfix
• ePO 4.6.8 and later
• ePO 5.1 with 64-bit hotfix
• ePO 5.1.1 and later

it dosen't list 4.6.6 with hotfix as protected so think you need to upgrade it and then patch

Message was edited by: pierce - fixed typo on 5/20/14 7:11:07 AM CDT

[twenden · Accepted solution]

Have installed on our test ePO 5.1 server. It only takes 10 minutes to install and so far so good. I would install it as soon as possible as 2 of the 6 fixes have a CVSS score of 10. A CVSS score of 10 is the highest and classified as the most severe.

Message was edited by: twenden on 5/20/14 7:12:47 AM CDT

[pierce]

Yes the CVSS score being a 10 is something that caught my eye! I know my security team advised me to upgrade ASAP as soon as they saw that.