Defect ID

Description

CMS-6406

Scan Error is displayed when VSP services are restarted during the scan phase, after the maintenance mode is stopped

SUPP-826

FSM does not support file extension exclusions with "-" (dash)

SUPP-855

The library libvsp-hmm-agent.so generates incidents after addition to the global allowlist exclusion list

SUPP-882

Unable to send email to the customer's help desk

SUPP-884

VSP 2.5.0 - High CPU Usage noticed after VSP services are started on Windows 2019 server

SUPP-892

Probes that are registered with 2.7.2 CMS failed to upgrade from 2.4.2 to 2.7.2

SUPP-898

VSP Probe 2.7.1 Upgrade created issues on IIS Web servers

SUPP-905

Re-installation/Uninstallation of password protected Windows 2.7.2 Probe fails via IBM BigFix

SUPP-907

Applications are blocked after Probes are upgraded from 2.7.0 to 2.7.2 in Protect Mode

SUPP-910

Probe 2.7.2 installation failed with error "193: %1 is not a valid Win32 application"

SUPP-914

Login fails after provisioning the Application Checkmarx

Category

Description

Known Issue/ Caveat

Installation

CI phase fails on Ubuntu 20 container

CI phase fails on Ubuntu 20 container if the docker version 19.03.0 - 19.03.8 is installed on the Management node used for installation. This is due to a known issue in these docker versions

Recommended Workaround: Install docker version: 19.03.9 on the Management Node

Known Issue

FSM (File System Monitoring)

File Rename incident is detected with "fileName" and "filePath" as "NON_MONITORED_PATH"

For a File rename incident, "fileName" and "filePath" attributes are reported as "NON_MONITORED_PATH" after deletion of the file contents

Known Issue

Duplicate incidents and events are generated after file modification

Duplicate incidents and events are generated after modification of an existing or new file with event types NEW_FILE, FILE_MODIFIED and FILE_RENAMED

Known Issue

(Windows 2008) Two incidents are generated for file rename action

For a file rename action, two Incidents FILE_RENAME and FILE_MODIFIED are reported in Windows 2008

Known Issue

Incidents are reported for excluded folders

When multiple Applications are associated with the same ASI and a few folders are excluded in one of them and not the others, incidents are reported for the excluded folders

Recommended Action: Ensure that the folders are excluded in all the associated Applications on CMS

Known Issue

VSP-Memory

Post BE attack, process may not restart for VM

Post BE attack, if an application is configured in the inline protect restart mode, it may not get restarted successfully.

Recommended Workaround: sudo must be present on the machine and must not require a password to execute when launched as root user

Known Issue

Apache 2.4 (httpd) is not instrumented when it is started as a service (Win 2016)

httpd service is not instrumented when it is started as a service. The process terminates.

Recommended Workaround: Do not start httpd as a service. Execute it from the console

Known Issue

(Windows) VSP-Memory fails to automatically re-instrument an Application sometimes

In Windows, when using auto-instrumentation for a service, VSP-Memory sometimes fails to re-instrument the application automatically, if the service is restarted via the Services window. This is because VSP-Memory-Assist does not process the application stop/start quickly enough

Recommended Workaround: In such cases, stop the service, wait up to 5 seconds before starting the service

Host Monitoring

All entries in the Global exclusion list are considered regular expression patterns

All entries in the Global exclusion list are considered regular expression patterns even if there are absolute paths present

Known Issue

In Mixed Mode, VSP-CLI logs error: “ERROR: ld.so: object 'libvsp-hmm-agent.so' from /etc/ld.so.preload cannot be preloaded: ignored.”
It has no adverse effect on the VSP-CLI functionality.

Some publishers did not get detected/Allowlisted during initial scan

Upon launch, Google Chrome browser, some libraries (signed by publisher 'ESET, spol. s r.o.') are loaded. The publisher is not listed in the publishers list in the initial scan. When the process is launched, this publisher gets allowlisted automatically (if auto-allowlist is enabled)

VSP does not report modified processes or libraries that belong to a package in systems that use prelink

VSP does not report modified processes or libraries that belong to a package in systems that use prelink. The prelink application inherently changes the binary checksum, so there is no true reference for VSP to use.

In Windows, when an application is started with or without the “.exe”, different detections by VSP may be possible

ACPs are specific to the command lines used when starting an application. In Windows, when an application is started with or without the ".exe", different detections by VSP may be possible

App Control Policies do not support any unicode character in any field

App Control Policies do not support any unicode character in any field

Linux HMM agent limitation

In Linux, VSP host monitoring injects its own HMM agent into every running process. The HMM agent expects a specific version of glibc. If the application loads its own custom glibc version that is not compatible with the HMM agent, the HMM agent may not load correctly causing some application issues

Exclusion on Child Type ACP rule does not work

Even when a child process added under exclusion in ACP, Child Exclusion is reported as incident

Publisher/Package list is not included when the host profile is exported

Publisher/Package list is not included when the host profile is exported. As a result, when the host profile is imported into CMS, the publisher/packages list may be missing and may generate incidents.

Fully statically-linked executables are not detected during the start up by HMM

Fully statically-linked executables are not detected during the start up by HMM. However, whenever the allowlist is published or there is a VSP host mode change, VSP host detects and checks the actively running statically-linked executables

Known Issue

For a small subset of applications started via the "service" command in Linux, VSP host does not detect the application start

In some cases, for a small subset of applications started via the "service" command in Linux, VSP host does not detect the application start, resulting in a potential false negative. However, each time the allowlist is published or the VSP host mode is changed, VSP host scans the system, that detects the running application if it is still running

Known Issue

"Access denied" message is not displayed when a process is blocked

"Access denied" message is not displayed when a process is blocked on Windows 2003 OS (32bit and 64 bit)

Out of box protection actions are not available for Windows 2003 servers

Out of box protection actions are not available for Windows 2003 servers

Execution of native image DLLs by Windows CLR runtime is not covered

Execution of native image DLLs by Windows CLR runtime is not covered under Virsec Process and Library Monitoring capabilities

"Stop Maintenance Mode" functionality is not working as expected

Incidents are reported after stopping the maintenance mode for Python.exe that was installed during maintenance

Windows 2003: Unverified Process with long directory or process name is not blocked

Unverified Process with long directory or process name is not blocked on Windows 2003 servers (32 and 64 bit)

Host Monitoring features do not work on encrypted files

Host Monitoring features do not work on encrypted files that cannot be decrypted by the SYSTEM user

For ACPs configured for interpreter shells like cmd.exe or powershell.exe, HMM does not evaluate commands executed directly in them

For ACPs configured for interpreter shells like cmd.exe or powershell.exe, HMM does not evaluate commands executed directly in them against the commandline ACP rules.

Example: If an ACP is created for "cmd.exe" with a commandline deny rule for "echo":

1. Execution of the command "cmd.exe /c echo hello" is reported to CMS as an incident

2. Opening cmd.exe and execution of the command "echo hello" inside the interpreter does not result in incident detection

After upgrade to VSP 2.7, the scripts in the allowlist remain in the library section

After upgrade to VSP 2.7, the scripts in the allowlist remain in the library section. They are not listed in the scripts section

Scan Error persists even after recovering probes from HMM crash

When Probes are in maintenance mode for a certain period of time and stopped, a scan is initiated. If the VSP-Manager is stopped/restarted during the scan, an error is displayed on CMS. This persists even after VSP-Manager restarts

On Windows 2003, new publishers are not added to the publisher list

On Windows 2003 32-bit hosts, new publishers are not added to the publisher list if the certificate has Sha384 as the Digest Algorithm

Reporting

On premise Kubernetes - based deployment:Generated Reports cannot be viewed

In an on-premise Kubernetes - based multi-pod deployment, generated reports cannot be viewed. Error 404 is displayed. This occurs when the components JReports and Ngnix Client service are deployed on different worker nodes

Known Issue

The error may be due to the occurrence of SQL connectivity error in the JReports Server.

Recommended Workaround: If the error SQLNonTransientConnectionException is found, restart the JReports server

VSP-Web (on Web Server)

Compressed Responses are not supported

VSP-Web (on Web Server) does not support compressed Responses.Example: gzip

Limitation

Web Protection (On Web Server)-Apache – pop-up is not displayed

Web Protection (On Web Server)-Apache: Permission denied popup is not displayed. The request is blocked as expected with no impact to functionality

Known Issue

VSP-Web

Long polling or WebSocket based requests are not supported

Long polling or WebSocket based requests are currently not supported by VSP Web

Limitation

Asynchronous servlet model is not supported

Applications leveraging Async-API are not supported

Limitation

Permission denied message is displayed along with the Application message

For some inline protection cases, along with the Permission Denied pop-up message, the application response is also displayed

Known Issue

VSP 2.5.0 or higher: VSP-Web for Ruby is not backward compatible

VSP-Web for Ruby on Rails is not backward compatible for 2.4.x and lower

Impact: It impacts VSP-Web for Ruby, where CMS is upgraded to VSP 2.5 or higher and Probe is still of a previous version

Recommended Workaround: Ensure that VSP Probe is also upgraded to version 2.5 or higher

Limitation

RFI profile exclusion list is not considered for perimeter level RFI attack

RFI profile exclusion list is not considered for perimeter level RFI attack

Recommended Workaround: Add the relevant exception to circumvent the issue

Known Issue

.Net Core: VSP deletes comments from the file web.config

.Net Core: While provisioning application, VSP deletes comments from the file web.config of the application

Known Issue

Invalid CSRF token is reported to CMS when two j-session IDs are present

Invalid CSRF token is reported to CMS when two j-session IDs are sent in the request. VSP supports monolithic applications only. This occurs with multiple session providers only

Known Issue

VSP Memory Exploit Protection

MEP does not detect a variant of PowerShell Exploit

MEP does not detect a variant of PowerShell Exploit if both the source and target processes are the same

Limitation

Multiple incidents are reported for powershell

Multiple incidents are reported for powershell since Windows attempts to spawn a new powershell with a shortened path and VSP blocks all these attempts

Expected Behavior

Some Exploits are reported as Process Hollowing due to shared API

Exploits such as Credential API Hooking, TLS Callback Injection and Thread Execution Hijack can be reported as Process Hollowing due to the sharing of API calls with Process Hollowing in Windows 2016 and Windows 2019 machines

Known Issue

Two events are detected as part of the OS Credential Dumping attack

Utility tools like ProcDump used to collect memory dump of a process, clones the target process before creating the dump file when used with the recursive flag (-r). In such cases, two events are generated, one for the original process and the other for the cloned process. Both the events are detected as part of the OS Credential Dumping attack coverage

Known Issue

General

VSP-CLI command gives error while executing stop/restart VSP-Manager service

When VSP-CLI command is used to stop/restart VSP-Manager service (individually or all the services), there is an error “Exception occurred during the initialization of the VSP Kafka consumer”

Recommended Workaround: Close the current session and stop/restart the VSP-Manager service in a new session

Known Issue

For VSP CMS on an AWS environment ensure that only the External Email server is configured

For VSP CMS on an AWS environment ensure that only the External Email server is configured

Limitation

Email Subscription for application-based incidents

If any application-based incident is configured for Email Subscription, ensure that the Host is NOT selected

Known Issue

VSP is not supported for workloads running SELinux or AppArmor in Enforcing mode

VSP is not supported for workloads running SELinux or AppArmor in Enforcing mode

Limitation

User may be unable to delete instances

User may be unable to delete instances in a larger environment with more than 20 thousand open incidents

Known Issue

Protection Engine: In Windows if the log path contains spaces, log rotation does not work

When the protection engine is configured with protection actions associated with log path contains spaces, log rotation does not work in Windows

Recommended Workaround: Ensure that the configured log path does not contain spaces

Limitation

Application and host profiles do not auto- associate if the tag names contain spaces

Application and host profiles do not auto- associate if the application and host tag names contain spaces

Recommended Workaround: Ensure that no spaces are present in the tags

Limitation

Splunk connection using proxy with RootCA configuration is not supported

Splunk connection using proxy with RootCA certificate configuration is not supported by CMS

Limitation

Windows 2008: Probe uninstallation using -U sometimes displays error

Probe uninstallation using the option -U, with password configured displays error

Recommended Workaround: Execute the uninstallation command again for uninstalling the Probe

Known Issue

User logged in automatically after the CMS application is closed from Task Manager

CMS Application is closed directly from Task Manager. User is logged in automatically when CMS is accessed through a new window

Caveat