Host Intrusion Prevention 8.0.0 Patch 2 Hotfix Rollup 803520 Release Notes

Technical Articles ID: KB77323
Last Modified: 6/19/2014

Environment

McAfee Host Intrusion Prevention 8.0 Patch 2 Hotfix Rollup 803520

Summary

Host Intrusion Prevention (Host IPS) 8.0.0 Patch 2 Hotfix Rollup 803520

Package Date: February 4, 2013

Rating
McAfee considers this release High Priority for all environments. Failure to apply a High Priority update might result in potential business impact. See KB51560 for information on ratings.

IMPORTANT: See the Problem section for issues found after applying this hotfix.

Resolved issues
The following issues have been fixed in this release:

Article	Reference	Description
SB10034	791162	Issue: A vulnerability allowed unauthorized privilege escalation by an authenticated user. Resolution: This update resolves the vulnerability. Refer to online Security Bulletin SB10034 for the most current details.
KB76593	806069	Issue: System bugcheck D1 in mfefirek.sys when using Host IPS 8.0 Patch 2 and certain VPN clients. Resolution: Certain VPN clients exposed a compatibility issue between Microsoft’s WFP framework and the McAfee WFP driver. McAfee implemented a workaround in the WFP driver that resolves the issue.
KB76210	771202	Issue: Some VPN clients failed to establish a VPN link when Host IPS 8.0 was installed on the system. Resolution: Updated the firewall logic to meet certain VPN client requirements.
	793215	Issue: Host IPS Content version 4517 caused Firefox and IE browsers to hang with the API engine. Resolution: Extended the logic to handle some duplicate Windows notifications.
	798767	Issue: Invalid firewall policies caused Naprdmgr.exe to crash during policy enforcement. Resolution: Added logic to better handle invalid policies.
KB76595	803520	Issue: Firesvc.exe caused high CPU usage. Resolution: Improved the efficiency of the service.
KB76594	807869	Issue: DriverVerifier testing caused Mfehidk.sys bugcheck C1 on Microsoft Windows 7. Resolution: Fixed a buffer overrun issue.
	813045	Issue: Host IPS 8.0 did not register for ownership of firewall categories required for Microsoft DirectAccess. Resolution: Host IPS now registers for the BootTimeRuleCategory, FirewallRuleCategory, and StealthRuleCategory categories.
	788146	Issue: McTray.exe caused an error at system logon. Resolution: Fixed some asynchronous RPC issues.
	782946	Issue: Excessive memory usage by NaPrdMgr.exe when Host IPS 8.0 is installed. Resolution: Fixed a memory leak.
	733085	Issue: Host IPS blocked traffic in a Location Aware Group for Checkpoint VPN. Resolution: Fixed Location Aware Group matching logic.

The Product Version Build Number from Help\About is:

8.0.0.2482

The following binaries are version 15.0.0.539:

[INSTALLDIR]\VSCore\release\* [Minus HipShieldK.*, FireNfcp.*]
[INSTALLDIR]\VSCore\x64\* [Minus FireNfcp.*]

Problem

Documented Known Issues:
At time of release, there were no additional known issues that were not already included in the posted Release Notes file. However, the following lists known issues found after applying this hotfix.

CRITICAL: No critical issues at RTW.

Non-critical:

Article

Reference

Description

KB77809

843301

Issue: Windows Action Center reports that the firewall is managed by Host Intrusion Prevention 8.0 after HF803520 is applied.

Resolution: This issue has been resolved in Hotfix 843301. See the KnowledgeBase article for details.

KB76595

851314

Issue: FireSvc.exe causing high CPU after upgrade to Host Intrusion Prevention 8.0 Patch 2 or Hotfix 803520.

Resolution: Additional resolution for this issue is included in the Host IPS Signature Content being posted May 14, 2013. See the KnowledgeBase article for details.

Solution

Apply Host IPS 8.0 Patch 2 Hotfix Rollup 803520, which is available from the McAfee ServicePortal.

The Hotfix Rollup 803520 package is available to Registered ServicePortal users only. Do the following to download Software Updates:

Log in to the McAfee ServicePortal at http://mysupport.mcafee.com.
NOTE: See KB54031 for information on ServicePortal registration.
Click Download Software Updates.
Under Product Patches, locate Host IPS 8.0.0 Patch 2 Hotfix Rollup 803520 and download this hotfix.

Installation instructions
Host IPS 8.0.0 Patch 2 Hotfix Rollup 803520 updates Host IPS Client 8.0.0 Patch 2 only. See the Host IPS 8.0 Patch 2 Known Issues (KB74505), for additional information on Patch 2 known issues.

The Host IPS 8.0.0 Hotfix 803520 installation does not require a restart, but might cause a brief interruption in network traffic. See KB59945 for the most current information.

To install using ePolicy Orchestrator (ePO):

Add the hotfix package to the ePO Repository.
Deploy using an ePO Agent Update Task.

To install locally, run the patch installer on the target system:

Disable Host IPS protection with an ePO delivered policy or in the local client UI. See KB58629 for details on manually disabling Host IPS protection.
Run McAfeeHIP_ClientHotfix_803520.exe.
Enable Host IPS protection.

Attachment

McAfeeHIP_ClientReadmeHotfix803520.pdf
23K • < 1 minute @ broadband

Affected Products

Host Intrusion Prevention 8.0
Known Issue/Product Defect

Languages:

This article is available in the following languages:

German
English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Host Intrusion Prevention 8.0.0 Patch 2 Hotfix Rollup 803520 Release Notes

Environment

Summary

Problem

Solution

Attachment

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Host Intrusion Prevention 8.0.0 Patch 2 Hotfix Rollup 803520 Release Notes

Environment

Summary

Problem

Solution

Attachment

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title