This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UPDATE - IPS Pattern Update fixed

Hi Everyone,

We have tested that the new IPS patterns on the Up2Date server are fixed and working.

If your system is affected there are two ways to get the updated and fixed patterns:

1) WebAdmin (the preferred way)

- login to WebAdmin via https://YOUR_ASG_IP:4444
- go to left menu item “Network Security”
- go to sub menu item “Intrusion Prevention”
- disable the IPS system (if not already done)
- go to the last tab “Advanced”
- click on the green “+” sign under “Modified rules”
- enter under “Rule ID”: 15851 and check “Disable this rule”
- click “Save”
- click again on the green “+” sign under “Modified rules”
- enter under “Rule ID”: 16576 and check “Disable this rule”
- click “Save”
-     go back to the first tab and activate the IPS system again

This will fix the problem and install the new IPS pattern.

PLEASE NOTE: Depending on the speed and workload of your ASG it can take a minute!

2. Command line (only for experienced users)
-     login via SSH or local on console
-     become "root"
-     enter "echo 1 > /proc/net/nf_condition/ips"

That's all and will do the following:

*     it will bypass completely the IPS system on lowest level (ASG is online then), independent if IPS is activated or deactivated on WebAdmin

*     the new IPS pattern will be fetched and installed

*     the next IPS pattern update we will provide later today will remove this bypass automatically and the ASG works like configured (with new pattern)

If your ASG uses ACC as an Up2Date cache: do the same above for these ASGs if there are affected. There is no todo on ACC.

If your ASG is not and was not affected, because IPS was turned off last 8 hours or not online and therefore didn't fetched the corrupt pattern then there is no action needed. The old, corrupt patterns are removed from the Up2Date server. It is safe the activate IPS now and set the ASG online again to fetch IPS pattern.

We are very sorry for this inconvenience.

Best regards,

Dominic Schmidl

This thread was automatically locked due to age.

Parents

0 AlanT_01 over 15 years ago

I can answer a few questions.. I'm sorry, I would have posted here sooner, but I have been focused elsewhere today.
First off, how to tell if the IPS pattern is installed:
The global pattern version number will have been raised by clam and avira patterns that were released after the fixed IPS pattern, so the global pattern version can't be used to tell if you have the updated patterns or not. What you are looking for, is IPS pattern version 7.173. If this is installed, then your system is fixed. You can find this in the up2date log. From the shell, you can check todays logs quickly, with the following command:
cat /var/log/up2date.log |grep '7.173| grep 'package="ips"''

That should return a log something like this:
2010:05:07-05:54:17 wilmington auisys[12235]: id="371Z" severity="info" sys="system" sub="up2date" name="Successfully installed Up2Date package" status="success" action="install" package_version="7.173" package="ips"

If you see that, then your system has installed the latest IPS pattern.

As for how this happened, Jan covered it better than I could. please see his post for the dirty details. In short though, the build server was recently upgraded to support the upcoming v8 release, but was put into production too soon. There were problems that allowed a pattern to be released without being thoroughly tested on every product version. From what I've seen, the new build server is pretty spectacular, and way more capable than our previous system. I don't believe this was a fault in its capabilities.

Regarding the up2date servers, they are all functional. If a system can't contact one server, then it will just move down the list and use another update server. The errors reported in the listed thread are not critical failures.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 AlanT_01 over 15 years ago

I can answer a few questions.. I'm sorry, I would have posted here sooner, but I have been focused elsewhere today.
First off, how to tell if the IPS pattern is installed:
The global pattern version number will have been raised by clam and avira patterns that were released after the fixed IPS pattern, so the global pattern version can't be used to tell if you have the updated patterns or not. What you are looking for, is IPS pattern version 7.173. If this is installed, then your system is fixed. You can find this in the up2date log. From the shell, you can check todays logs quickly, with the following command:
cat /var/log/up2date.log |grep '7.173| grep 'package="ips"''

That should return a log something like this:
2010:05:07-05:54:17 wilmington auisys[12235]: id="371Z" severity="info" sys="system" sub="up2date" name="Successfully installed Up2Date package" status="success" action="install" package_version="7.173" package="ips"

If you see that, then your system has installed the latest IPS pattern.

As for how this happened, Jan covered it better than I could. please see his post for the dirty details. In short though, the build server was recently upgraded to support the upcoming v8 release, but was put into production too soon. There were problems that allowed a pattern to be released without being thoroughly tested on every product version. From what I've seen, the new build server is pretty spectacular, and way more capable than our previous system. I don't believe this was a fault in its capabilities.

Regarding the up2date servers, they are all functional. If a system can't contact one server, then it will just move down the list and use another update server. The errors reported in the listed thread are not critical failures.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data