<<<>>> Trend Micro, Inc. November 12, 2013 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Trend Micro(TM) ServerProtect(TM) for Linux(TM) 3.0 Service Pack 1 Patch 5 - Build 1396 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Note: This readme file was current as of the date above. However, all customers are advised to check Trend Micro's web site for documentation updates at: http://docs.trendmicro.com/ Register online with Trend Micro within 30 days of installation to continue downloading new pattern files and product updates from the Trend Micro web site. Register during installation or online at: http://olr.trendmicro.com/ Contents =================================================================== 1. About ServerProtect for Linux 1.1 Overview of this Release 1.2 Who Should Install this Release 2. What's New 2.1 Enhancements 2.2 Resolved Known Issues 3. Documentation Set 4. System Requirements 5. Installation/Uninstallation 5.1 Installation 5.2 Uninstallation 6. Post-installation Configuration 7. Known Issues 7.1 Installation Issue 8. Release History 8.1 Patch 1 8.2 Patch 2 8.3 Patch 3 8.4 Patch 4 9. Files Included in this Release 10. Contact Information 11. About Trend Micro 12. License Agreement =================================================================== 1. About ServerProtect for Linux ======================================================================== ServerProtect for Linux provides comprehensive protection against computer viruses/spywares, Trojans, worms, and other security risks for file servers based on the Linux operating system. Managed through an intuitive, portable Web-based console or Linux command line console, ServerProtect provides centralized virus scanning, pattern updates, event reporting, and antivirus configuration. Award: Winner of SYS-CON Linux and Enterprise Open Source Readers' Choice Award Certification: ServerProtect for Linux 3.0 fully supports Novell(R) OES2 and is Novell YES certified for the following: o 32-bit operating systems (See http://developer.novell.com/yes/92344.htm) o 64-bit operating systems (See http://developer.novell.com/yes/92345.htm) 1.1 Overview of this Release ===================================================================== Patch 5 resolves issues found in ServerProtect for Linux 3.0 after the release Service Pack 1 Patch 4. Refer to the "What's New" section for enhancements implemented in this release. 1.2 Who Should Install this Release ===================================================================== You should install this patch release if you are currently running any ServerProtect for Linux 3.0 package released before Patch 5. 2. What's New ======================================================================== This release incorporates all previous hot fixes since the release of ServerProtect for Linux 3.0. Note: Please install this Patch before completing any procedures in this section (see "Installation"). This patch addresses the following issues and includes the following enhancements: 2.1 New Enhancements ===================================================================== ServerProtect for Linux 3.0 Service Pack 1 Patch 5 includes the following enhancements: Enhancement 1: Kernel Hooking Module Source Code - The Kernel Hooking Module (KHM) source code has been updated to version 3.0.1.0010. Refer to the following web site for more information about the latest KHM source code: http://downloadcenter.trendmicro.com/ index.php?clk=tbl&clkval=111®s=NABU&lang_loc =1#undefined Enhancement 2: Apache(TM) Server - The Apache server has been upgraded to version 2.2.25, and the OpenSSL module in the Apache server to version 1.0.1e. Enhancement 3: ActiveUpdate Module - The ActiveUpdate (AU) module has been upgraded to version 2.85 and the following three folders: - "/opt/TrendMicro/SProtectLinux/AU_Cache" - "/opt/TrendMicro/SProtectLinux/AU_Temp" - "/opt/TrendMicro/SProtectLinux/AU_Log" have been moved to: - "/opt/TrendMicro/SProtectLinux/AU_Data/AU_Cache" - "/opt/TrendMicro/SProtectLinux/AU_Data/AU_Temp" - "/opt/TrendMicro/SProtectLinux/AU_Data/AU_Log" 2.2 Resolved Known Issues ===================================================================== ServerProtect for Linux 3.0 Service Pack 1 Patch 5 resolves the following issues: Issue 1: ServerProtect for Linux sends a notification for an outdated pattern file even when the pattern file is up-to-date. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 1: [Hot Fix 1358] This hot fix modifies the way ServerProtect for Linux determines whether a pattern file is up-to-date or not. This ensures that ServerProtect for Linux sends out an outdated pattern file notification only when a pattern file is outdated. Issue 2: Users do not receive any notifications after ServerProtect for Linux disables the Real-time Scan. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 2: [Hot Fix 1359] This hot fix adds an option to ensure that users receive notifications even after ServerProtect for Linux disables the Real-time Scan. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Procedure 2: To enable this feature: a. Install this Patch (see "Installation"). b. Stop ServerProtect for Linux. c. Open the "tmsplx.xml" file under the "/opt/TrendMicro/SProtectLinux/" folder. d. Locate the "AlertRealtimeScanStatus" key under the "Scan" section and set it to the following:

e. Save the changes and close the "tmsplx.xml" file. f. Start ServerProtect for Linux. Issue 3: When users choose to update multiple components and one or more components, but not all, update successfully, the last update time of all selected components will be updated. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 3: [Hot Fix 1363] This hot fix ensures that only the last update time of successfully updated components are changed in this case. Issue 4: Trend Micro Control Manager(TM) does not support the display of any information about the new engine for the Common Internet File System (CIFS) in ServerProtect for Linux. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 4: [Critical Patch 1366] This critical patch ensures that Control Manager displays the necessary information about the new engine for CIFS in ServerProtect for Linux. Issue 5: The warning message that appears during an update to warn users that the product license has expired contains a typographical error. In the message, "perion" was used instead of "period". ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 5: [Hot Fix 1371] This hot fix corrects the typographical error in the notification. Issue 6: The cron job setting is not updated with all the rest of the ServerProtect for Linux settings during configuration replication from one computer to another through the Control Manager console. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 6: [Hot Fix 1372] This hot fix ensures that the cron job setting is always updated with the rest of the ServerProtect for Linux settings during configuration replication from one computer to another through the Control Manager console. Issue 7: By default, Scheduled Scan and Manual Scan modify the last access time of files after scans. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 7: [Hot Fix 1383] This hot fix adds an option to prevent Scheduled Scan and Manual Scan from modifying a file's last access time if the file is not infected. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Procedure 7: To enable this feature: a. Install this Patch (see "Installation"). b. Stop ServerProtect for Linux. c. Open the "tmsplx.xml" file. d. Locate the "DisableAtimeNoChange" key under the "Scan" section and set it to the following:

e. Save the changes and close the file. f. Start ServerProtect for Linux. Issue 8: During a scheduled update, ServerProtect for Linux may use the wrong working directory when it tries to update again. This triggers a "PATCH_ERROR" message in "TmuDump.txt". ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 8: This Patch ensures that ServerProtect for Linux always uses the correct working directory during scheduled updates. 3. Documentation Set ======================================================================== In addition to this readme.txt, the documentation set for this product includes the following: o Getting Started Guide -- product overview, installation planning, installation steps and basic information intended to help you deploy ServerProtect for Linux smoothly. o Administration Guide -- Provides post-installation instructions on how to configure the settings to help you get ServerProtect for Linux "up and running". Also includes instructions on performing other administrative tasks for the day-to-day maintenance of ServerProtect for Linux. o Readme.txt files -- version enhancements, basic installation, known issues, and release history. o Electronic versions of the printed manuals are available at: http://docs.trendmicro.com/ o Online help -- Context-sensitive help screens that provide guidance for performing a task. o TrendEdge is a program for Trend Micro employees, partners, and other interested parties that provides information on unsupported, innovative techniques, tools, and best practices for Trend Micro products. The TrendEdge database contains numerous documents covering a wide range of topics. http://trendedge.trendmicro.com o Knowledge Base -- a searchable database of known product issues, including specific problem-solving and troubleshooting topics. http://esupport.trendmicro.com 4. System Requirements ======================================================================== Install this patch only on computers running ServerProtect for Linux 3.0 or higher versions released before this Patch. Note: Refer to the ServerProtect readme file for detailed system requirements for installing the product. 5. Installation/Uninstallation ======================================================================== 5.1 Installation ===================================================================== This section explains key steps for installing the software. Refer to the "Administrator's Guide" (AG) for detailed information. To install this Patch: 1. If you have registered or are going to register ServerProtect for Linux to Control Manager, make sure the latest Control Manager patch has been applied. 2. Log on as a root user. 3. Copy "splx_30_lx_en_sp1_patch5.tar.gz" to a working directory such as "/tmp/workdir". 4. Type the following commands: # cd /tmp/workdir # tar zxvf splx_30_lx_en_sp1_patch5.tar.gz # chmod u+x splx_30_lx_en_sp1_patch5.bin #./splx_30_lx_en_sp1_patch5.bin Notes: - The last command stops the ServerProtect services before installing this Patch. - ServerProtect services automatically starts after the system completes the installation process. 5.2 Uninstallation ===================================================================== To remove Patch 5 and roll back to the previous ServerProtect for Linux build: 1. Run the following command: #rpm -e splx-3.0-sp1-patch5 Note: As the configuration file, "tmsplx.xml", used by Patch 5 may not be compatible with the one used by the previous ServerProtect for Linux release version, the configuration file will be saved as "tmsplx.xml.p5.rpmsave" when you uninstall this Patch. ServerProtect for Linux will use the configuration file previously backed up when installing this Patch. 2. Manually compare and synchronize the settings between the backed-up configuration file and the configuration file used by Patch 5 to apply the same custom settings to ServerProtect for Linux. Note: You can retrieve the ServerProtect for Linux 3.0 RPM information from the "Version.ini" file in the "/opt/TrendMicro/SProtectLinux/" information folder. Refer to Section 7.1 for more information. 6. Post-Installation Configuration ======================================================================== No post-installation steps are required. Note: Trend Micro recommends that you update your scan engine and virus pattern files immediately after installing the product. 7. Known Issues ======================================================================== 7.1 Installation Issue --------------------------------------------------------------------- Patch 5 must remove the previous ServerProtect for Linux 3.0 Patch RPM information from the RPM database to prevent inconsistencies. But due to the limitation of RPM, the previous ServerProtect for Linux 3.0 Patch information could not be restored to the RPM database. Instead, it is stored in "/opt/TrendMicro/SProtectLinux/Version.ini". 8. Release History ======================================================================== 8.1 Patch 1 ===================================================================== 8.1.1 Enhancements ===================================================================== ServerProtect for Linux 3.0 Service Pack 1 Patch 1 provides the following enhancements: Enhancement 1: Internal HTTP Server - The internal HTTP server for ServerProtect has been updated to resolve some security issues. Enhancement 2: KHM Source Code - The KHM source code in the latest KHM packages has been updated. Enhancement 3: Kernel Debug Log - A dynamic enabling feature has been added to the kernel debug log. 8.1.2 Resolved Known Issues ===================================================================== ServerProtect for Linux 3.0 Service Pack 1 Patch 1 resolves the following issues: Issue 1: ServerProtect for Linux does not send event logs to Control Manager if only the engine or spyware pattern is updated. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 1: [Hot Fix 1222] ServerProtect for Linux now sends event logs to Control Manager for engine or spyware pattern only updates. This enables Control Manager to send out email notifications for the status of the events, if configured to do so. Issue 2: When ServerProtect for Linux registers to Control Manager using Fully Qualified Domain Name (FQDN), the registration process may fail during the Linux system startup if the network environment is not ready. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 2: [Hot Fix 1224] ServerProtect for Linux now attempts to register several times within a specified period of time if the Control Manager registration fails. Issue 3: When stopping ServerProtect for Linux services, ServerProtect for Linux cannot terminate the scheduled scanning process if the real-time scanning function is not working. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 3: [Hot Fix 1234] ServerProtect for Linux now stops the scheduled scanning process normally when executing the "/etc/init.d/splx stop" command to stop the ServerProtect for Linux services. Issue 4: Even when the pattern file or scan engine is updated successfully, ServerProtect for Linux may generate a system log "ActiveUpdate not completed" with the reason "ActiveUpdate successfully downloaded the patch files. Patch update is now in progress". ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 4: [Hot Fix 1241] The "WaitingTime" parameter has been added in the "ActiveUpdate" section of the "tmsplx.xml" file. The default value for the "WaitingTime" parameter is "60" seconds which is adequate for most applications. Users can reconfigure this value as needed. Issue 5: ServerProtect for Linux cannot register to Control Manager if the domain information in "/etc/resolve.conf" is too long. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 5: [Hot Fix 1246] Trend Micro has changed the way ServerProtect retrieves the host machine domain name to resolve the issue. Issue 6: When ServerProtect for Linux performs an update and all components are still up-to-date, the event log displays incorrect information. This prompts Control Manager to send an email notification stating "Update unsuccessful". ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 6: [Hot Fix 1247] ServerProtect for Linux now records this update as a successful update; Control Manager notes that there is no update needed and does not send out an "Update unsuccessful" notification. Issue 7: ServerProtect for Linux does not send email notifications when it detects a security risk by manual scan or scheduled scan. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 7: [Hot Fix 1250] The "AlertInfectionFoundByMS" hidden key has been added to the "tmsplx.xml" file. When enabled, this key prompts ServerProtect for Linux to send email notifications for a detected security risk after a manual scan or scheduled scan. Issue 8: The PR page displays a grace expiry date that is one month earlier than the real grace expiry date. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 8: [No Hot Fix] The PR page now displays the correct grace expiry date. Issue 9: The "splxhttpd" service does not stop properly if the process ID of a newly-created "splxhttpd" process is higher than the one created before it. The same issue affects the "entity" process. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 9: [No Hot Fix] ServerProtect for Linux now uses a new method to stop the "splxhttpd" and "entity" processes in the "splxhttpd" and "splxcore" script. This enables ServerProtect for Linux to stop the two processes properly. 8.2 Patch 2 ===================================================================== 8.2.1 Enhancements ===================================================================== ServerProtect for Linux 3.0 Service Pack 1 Patch 2 provides the following enhancements: Enhancement 1: KHM Source Code - the KHM source code has been updated. Refer to the following web site for more information about the latest KHM source code: http://www.trendmicro.com/download/ kernel.asp?prodid=20 Enhancement 2: ServerProtect for Linux Web Console - The ServerProtect for Linux web console to accept square brackets ("[" and "]"). Enhancement 3: Legacy Pattern Release Files- ServerProtect for Linux can now be configured to use legacy pattern release files. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Procedure 3: To enable the option: a. Open the "tmsplx.xml" file using a text editor. b. Change the value for "PatternType" to "PATTERN_VSAPI_LEGACY". c. Restart ServerProtect for Linux using the following command: /etc/init.d/splx restart Note: When a higher pattern version is available, the key will take effect only after a successful pattern update. Enhancement 4: Registration Timeout - Users can now set the timeout value when ServerProtect registers to Control Manager. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Procedure 4: To set the timeout value: a. Open the "tmsplx.xml" file using a text editor. b. Add the "CMRegistrationTimeout" option under the "Configuration" section and set the value to the timeout duration in seconds.

c. Restart "splx" using the following command: /etc/init.d/splx restart Enhancement 5: KHM now supports the following kernels of Red Hat(TM) 4/5 and SUSE Linux Enterprise 10: Red Hat Enterprise Linux Server/Desktop 4 (i686 and x86_64) - 2.6.9-89.0.20.ELsmp i686 - 2.6.9-89.0.20.EL i686 - 2.6.9-89.0.20.ELsmp x86_64 - 2.6.9-89.0.20.EL x86_64 Red Hat Enterprise Linux Server/Desktop 5 (i686 and x86_64) - 2.6.18-164.11.1.el5PAE i686 - 2.6.18-164.11.1.el5xen i686 - 2.6.18-164.11.1.el5 i686 - 2.6.18-164.11.1.el5 x86_64 - 2.6.18-164.11.1.el5xen x86_64 SUSE Linux Enterprise 10 (Server or Desktop) (i686 and x86_64) - 2.6.16.60-0.59.1-xen i686 - 2.6.16.60-0.59.1-smp i686 - 2.6.16.60-0.59.1-bigsmp i686 - 2.6.16.60-0.59.1-smp x86_64 - 2.6.16.60-0.59.1-xen x86_64 - 2.6.16.60-0.59.1-default x86_64 8.2.2 Resolved Known Issues ===================================================================== ServerProtect for Linux 3.0 Service Pack 1 Patch 2 resolves the following issues: Issue 1: If the debug log is enabled and users start a manual or scheduled update while an update process is running, the following message appears in the debug log: "Find the previous manual/schedule scan." ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 1: [No Hot Fix] The log has been changed to: "Find the previous manual/schedule update." Issue 2: When users register ServerProtect for Linux to Control Manager in text mode and the registration fails, the ActiveUpdate server still changes to "TMCM update server". This prompts ServerProtect for Linux to ask the user to unregister from Control Manager first the next time the user attempts to register to Control Manager in text mode. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 2: [No Hot Fix] This issue has been resolved. Issue 3: When users make changes to the manual scan options, some changes may not take effect when users start a manual scan by clicking "Scan now" from the "Summary" page. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 3: [No Hot Fix] This issue has been resolved. 8.3 Patch 3 ===================================================================== 8.3.1 Enhancements ===================================================================== ServerProtect for Linux 3.0 Service Pack 1 Patch 3 provides the following enhancements: Enhancement 1: KHM Source Code - The KHM source code has been updated. Refer go to the following web site for more information about the latest KHM source code: http://downloadcenter.trendmicro.com/ index.php?clk=tbl&clkval=111®s=NABU&lang_loc =1#undefined Enhancement 2: Users can now set the maximum size of files for scans. This improves the ServerProtect for Linux performance while scanning a large number of compressed files. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Procedure 2: To configure the option: a. Open "tmsplx.xml" file using a text editor. b. Add the "RealtimeNotScanSize" and "OnDemandNotScanSize" keys under the "Scan" section and set the value to a positive integer in megabytes.

c. Restart the ServerProtect for Linux service. Note: The key does not take effect if the value is set to "0". "RealtimeNotScanSize" is for real-time scans; "OnDemandNotScanSize" is for manual and scheduled scans. Enhancement 3: Users can now prevent ServerProtect from deleting the old "TmuDump.txt" ActiveUpdate log and append new ActiveUpdate logs to the existing log file instead. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Procedure 3: To enable the option: a. Open the "tmsplx.xml" file using a text editor. b. Add the "KeepAULog" option under the "ActiveUpdate" section and set its value to "1".

c. Restart the ServerProtect for Linux service. To control the total size of "TmuDump.txt": a. Open the "aucfg.ini" file under the "/opt/TrendMicro/SProtectLinux/" folder using a text editor. b. Add the "log_size" key under the "debug" section of the "aucfg.ini" file and set its value to the size limit in megabytes. For example, to set the size limit of the "TmuDump.txt" file to 1 MB, set: [debug] log_size = 1 c. Save the changes to the "aucfg.ini" file. Enhancement 4: Users can now create a list of approved process names. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Procedure 4: To create/edit the list of approved processes: a. Open the "tmsplx.xml" file using a text editor. b. Add the "RealtimeExcludeCommand" key under the "Scan" section and specify the approved processes separating multiple commands using a colon (:). For example:

Note: The feature can only take effect after you apply KHM version above 3.0.0.0005. This feature supports only the asterisk (*) and question mark (?) as wild card characters and behaves similarly to the real-time scan exclusion list setting. Enhancement 5: KHM now supports the use of the asterisk (*) and question mark (?) as wild card characters in the "Exclude these locations" and "Exclude the specified files" fields of the real-time scan exclusion list. 8.3.2 Resolved Known Issues ===================================================================== ServerProtect for Linux 3.0 Service Pack 1 Patch 3 resolves the following issues: Issue 1: While establishing an SMTP session with the email server to send email notifications from ServerProtect for Linux, ServerProtect for Linux sends a "HELO" command to the email server before the email server's greeting message arrives. As a result, ServerProtect for Linux treats the greeting message as the email server's response to the "HELO" command. This causes an error that prevents ServerProtect for Linux from establishing the SMTP session and sending out the email notification. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 1: [Hot Fix 1301] ServerProtect for Linux now sends out email notifications without issues. Issue 2: After applying ServerProtect for Linux 3.0 Service Pack 1 Patch 2, the ServerProtect real-time scan may take an unusually long amount of time to scan compressed files containing a large number of files even when the current real-time scan setting is set to skip most of the files. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 2: [Hot Fix 1307] An unnecessary delay operation added in Patch 2. has been deleted to resolve the issue. Issue 3: ServerProtect for Linux CDT tools do not collect some important information such as log messages, KHM information and the ActiveUpdate (AU) log. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 3: [Hot Fix 1310] ServerProtect for Linux CDT tools now collect "/var/log/messages", AU logs, and KHM information. Issue 4: ServerProtect for Linux does not automatically register to Control Manager if Control Manager starts after ServerProtect for Linux. When registration fails, ServerProtect for Linux will not show the registration information that was previously entered on the Web console. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 4: [Hot Fix 1311] An auto-register process has been added in ServerProtect for Linux to resolve this issue. Issue 5: A vulnerability exists in the ServerProtect for Linux 3.0 "splxhttpd" binary file containing OpenSSL 0.9.8i. Remote attackers can exploit this vulnerability and use malformed records in a HTTPS connection with ServerProtect for Linux to cause ServerProtect for Linux to stop unexpectedly. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 5: [No Hot Fix] The OpenSSL module in "splxhttpd" has been upgraded to resolve this issue. 8.4 Patch 4 ===================================================================== 8.4.1 Enhancements ===================================================================== ServerProtect for Linux 3.0 Service Pack 1 Patch 4 provides the following enhancements: Enhancement 1: KHM Source Code - The KHM source code has been updated. Refer to the following web site for more information about the latest KHM source code: http://downloadcenter.trendmicro.com/ index.php?clk=tbl&clkval=111®s=NABU&lang_loc =1#undefined Enhancement 2: Apache Server - The Apache server and the OpenSSL module in the Apache server have been updated. 8.4.2 Resolved Known Issues ===================================================================== ServerProtect for Linux 3.0 Service Pack 1 Patch 4 resolves the following issues: Issue 1: ServerProtect for Linux sends the last VSAPI and virus pattern update time to Control Manager in the GMT time zone. This prevents Control Manager from displaying the update time in local time. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 1: [Hot Fix 1318] ServerProtect for Linux now sends Control Manager the last VSAPI and virus pattern update time in local time. Issue 2: During manual scans, ServerProtect for Linux displays "ERROR" and "-1" scanned files on the Web page if the total number of files for scanning has not been updated in a long time. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 2: [Hot Fix 1321] This issue has been resolved. Issue 3: Under certain conditions, when the ServerProtect for Linux real-time scan detects a virus in a compressed file, the virus/spyware log for the compressed file does not display a virus name and action result. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 3: [Hot Fix 1322] The virus/spyware logs now display the correct virus name and action result. Issue 4: Error logs appear in "/var/log/messages" when some hidden keys introduced in Patch 3 are not configured. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 4: [Hot Fix 1340] Error logs now appear in "/var/log/messages" only when the debug log level is set to "5". Issue 5: ServerProtect for Linux uses an older version of the VSAPI engine on the Red Hat Enterprise Linux 6 platform. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution 5: [No Hot Fix] ServerProtect for Linux now uses the latest VSAPI engine for the Red Hat Enterprise Linux 6 platform. 9. Files Included in this Release ======================================================================== 9.1 For RedHat4_32/64, RedHat5_32/64, Asianux2.0_32/64, Asianux3.0_32/64, and SuSe10_32/64 ====================================================================== Filename Build No. ---------------------------------------------------------------------- splx 3.0.1396 splxcore 3.0.1396 splxhttpd 3.0.1396 vsapiapp 3.0.1396 splxmain 3.0.1396 SetTMDefaultExt 3.0.1396 splx_manual_scan 3.0.1396 splx_schedule_scan 3.0.1396 virus_type_finder 3.0.1396 libTMNotifymt.so.1 3.0.1396 libsplxcxml.so 3.0.1396 libProductLibrary.so 3.0.1396 DiagnosticTool 3.0.1396 entity 3.0.1396 CMconfig 3.0.1396 EncryptAgentPassword 3.0.1396 splxcomp 3.0.1396 splxport 3.0.1396 upcfg 3.0.1396 xmlvalidator 3.0.1396 splxhttpd.conf 3.0.1396 libapr-1.so.0.4.8 3.0.1396 libaprutil-1.so.0.5.2 3.0.1396 libexpat.so.0.5.0 3.0.1396 splxhttpd 3.0.1396 splxmain.8.gz 3.0.1396 checkBrowser.sh 3.0.1396 cmoption.cgi 3.0.1396 log_management.cgi 3.0.1396 login_and_register.cgi 3.0.1396 notification.cgi 3.0.1396 proption.cgi 3.0.1396 scanoption.cgi 3.0.1396 scanoption_set.cgi 3.0.1396 showpage.cgi 3.0.1396 srv_admin.cgi 3.0.1396 summary.cgi 3.0.1396 tmcm_sso.cgi 3.0.1396 viewlog.cgi 3.0.1396 wtcoption.cgi 3.0.1396 TMBIF 3.0.1396 AuPatch 2.85.1057 libpatch.so 2.85.1057 libtmactupdate.so 2.85.1057 cert5.db n/a x500.db n/a SPLX_CM_UI.zip n/a 9.2 For CentOS4_32/64, CentOS5_32/64, and SuSe11_32/64 ====================================================================== Filename Build No. ---------------------------------------------------------------------- DiagnosticTool 3.0.1396 cmsettings_no_reg.htm 3.0.1396 libProductLibrary.so 3.0.1396 libTMNotifymt.so.1 3.0.1396 vsapiapp 3.0.1396 entity 3.0.1396 splxmain 3.0.1396 splx_manual_scan 3.0.1396 splx_schedule_scan 3.0.1396 splxhttpd 3.0.1396 splxhttpd.conf 3.0.1396 SPLX.cgi 3.0.1396 libapr-1.so.0.4.8 3.0.1396 libaprutil-1.so.0.5.2 3.0.1396 libexpat.so.0.5.0 3.0.1396 server.crt 3.0.1396 splxport 3.0.1396 checkBrowser.sh 3.0.1396 CMconfig 3.0.1396 EncryptAgentPassword 3.0.1396 cmoption.cgi 3.0.1396 log_management.cgi 3.0.1396 login_and_register.cgi 3.0.1396 notification.cgi 3.0.1396 proption.cgi 3.0.1396 scanoption.cgi 3.0.1396 scanoption_set.cgi 3.0.1396 showpage.cgi 3.0.1396 srv_admin.cgi 3.0.1396 summary.cgi 3.0.1396 tmcm_sso.cgi 3.0.1396 viewlog.cgi 3.0.1396 wtcoption.cgi 3.0.1396 SetTMDefaultExt 3.0.1396 virus_type_finder 3.0.1396 splxcore 3.0.1396 TMBIF 3.0.1396 DiagnosticTool 3.0.1396 AuPatch 2.85.1057 libpatch.so 2.85.1057 libtmactupdate.so 2.85.1057 cert5.db n/a x500.db n/a SPLX_CM_UI.zip n/a 9.3 For RedHat6_32/64 ====================================================================== Filename Build No. ---------------------------------------------------------------------- server.crt 3.0.1396 splxhttpd.conf 3.0.1396 libvsapi.so 3.0.1396 libapr-1.so.0.4.8 3.0.1396 libaprutil-1.so.0.5.2 3.0.1396 libexpat.so.0.5.0 3.0.1396 splxhttpd 3.0.1396 splxport 3.0.1396 checkBrowser.sh 3.0.1396 entity 3.0.1396 splxmain 3.0.1396 CMconfig 3.0.1396 EncryptAgentPassword 3.0.1396 libProductLibrary.so 3.0.1396 cmoption.cgi 3.0.1396 log_management.cgi 3.0.1396 login_and_register.cgi 3.0.1396 notification.cgi 3.0.1396 proption.cgi 3.0.1396 scanoption.cgi 3.0.1396 scanoption_set.cgi 3.0.1396 showpage.cgi 3.0.1396 srv_admin.cgi 3.0.1396 summary.cgi 3.0.1396 tmcm_sso.cgi 3.0.1396 viewlog.cgi 3.0.1396 wtcoption.cgi 3.0.1396 SetTMDefaultExt 3.0.1396 splx_manual_scan 3.0.1396 splx_schedule_scan 3.0.1396 virus_type_finder 3.0.1396 splxcore 3.0.1396 TMBIF 3.0.1396 DiagnosticTool 3.0.1396 AuPatch 2.85.1057 libpatch.so 2.85.1057 libtmactupdate.so 2.85.1057 cert5.db n/a x500.db n/a SPLX_CM_UI.zip n/a 9.4 For CentOS6_32/64 ====================================================================== Filename Build No. ---------------------------------------------------------------------- entity 3.0.1396 splxmain 3.0.1396 splx 3.0.1396 libapr-1.so.0.4.8 3.0.1396 libaprutil-1.so.0.5.2 3.0.1396 libexpat.so.0.5.0 3.0.1396 splxhttpd 3.0.1396 CMconfig 3.0.1396 EncryptAgentPassword 3.0.1396 libProductLibrary.so 3.0.1396 cmoption.cgi 3.0.1396 log_management.cgi 3.0.1396 login_and_register.cgi 3.0.1396 notification.cgi 3.0.1396 proption.cgi 3.0.1396 scanoption.cgi 3.0.1396 scanoption_set.cgi 3.0.1396 showpage.cgi 3.0.1396 srv_admin.cgi 3.0.1396 summary.cgi 3.0.1396 tmcm_sso.cgi 3.0.1396 viewlog.cgi 3.0.1396 wtcoption.cgi 3.0.1396 SetTMDefaultExt 3.0.1396 splx_manual_scan 3.0.1396 splx_schedule_scan 3.0.1396 virus_type_finder 3.0.1396 splxcore 3.0.1396 TMBIF 3.0.1396 DiagnosticTool 3.0.1396 AuPatch 2.85.1057 libpatch.so 2.85.1057 libtmactupdate.so 2.85.1057 cert5.db n/a x500.db n/a SPLX_CM_UI.zip n/a 10. Contact Information ======================================================================== A license to the Trend Micro software usually includes the right to product updates, pattern file updates, and basic technical support for one (1) year from the date of purchase only. After the first year, Maintenance must be renewed on an annual basis at Trend Micro's then-current Maintenance fees. You can contact Trend Micro via fax, phone, and email, or visit us at: http://www.trendmicro.com Evaluation copies of Trend Micro products can be downloaded from our web site. Global Mailing Address/Telephone Numbers ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ For global contact information in the Asia/Pacific region, Australia and New Zealand, Europe, Latin America, and Canada, refer to: http://www.trendmicro.com/en/about/overview.htm The Trend Micro "About Us" screen displays. Click the appropriate link in the "Contact Us" section of the screen. Note: This information is subject to change without notice. 11. About Trend Micro ======================================================================== Trend Micro Incorporated, a global leader in Internet content security and threat management, aims to create a world safe for the exchange of digital information for businesses and consumers. A pioneer in server-based antivirus with over 20 years of experience, we deliver top-ranked security that fits our customers' needs, stops new threats faster, and protects data in physical, virtualized and cloud environments. Powered by the Trend Micro Smart Protection Network(TM) infrastructure, our industry-leading cloud-computing security technology and products stop threats where they emerge, on the Internet, and are supported by 1,000+ threat intelligence experts around the globe. For additional information, visit www.trendmicro.com. Copyright 2013, Trend Micro Incorporated. All rights reserved. Trend Micro, the t-ball logo, Smart Protection Network, ServerProtect, and Control Manager are trademarks of Trend Micro Incorporated and are registered in some jurisdictions. All other marks are the trademarks or registered trademarks of their respective companies. 12. License Agreement ======================================================================== Information about your license agreement with Trend Micro can be viewed at: http://us.trendmicro.com/us/about/company/user_license_agreements/ Third-party licensing agreements can be viewed: o By selecting the "About" option in the application user interface o By referring to the "Legal" page of the Getting Started Guide or Administrator's Guide