SIEM Flash Mitigation (unable to access the SIEM ESM UI)

Technical Articles ID: KB93257
Last Modified: 2022-11-07 16:10:31 Etc/GMT

Environment

SIEM Enterprise Security Manager (ESM) 11.x

IMPORTANT: Flash support won't be included in several web browsers after January 1, 2021. If you didn't upgrade to an SIEM version with support for the ESM Administrator application, you might be unable to use your system after this date. See the "Solution" field below for steps to upgrade if you can no longer access the ESM manager GUI.

Summary

Details related to the Flash End of Life (EOL) for the ESM 10.4 EOL extension:

Adobe Flash reached full EOL on December 31, 2020. As we continue to migrate the ESM UI from Flash to HTML5, all supported versions of ESM use Flash after the Flash EOL date.

We understand that under current circumstances, it might be hard for some customers to fully achieve migration to a supported ESM version by the designated EOL date.

To help address these concerns, we extended limited support for ESM 10.4 to August 31, 2021, originally scheduled for December 31, 2020.

NOTE: Because not all customers can fully migrate to a recent and supported version before the Flash EOL, we've taken other steps as outlined in the Action Plan below.

We've released an update for later versions of ESM to mitigate the impact of the Flash EOL. The update consists of a secured, containerized administrative utility, which is needed to access the remaining Flash-based parts of the ESM UI. The new utility is supported in Windows, Mac, and Linux clients.

You can still access all existing HTML5 parts of the UI using a standard browser, without the need for browser-based Flash. We've rolled out these updates as they became available, beginning in September 2020 with an update for 11.3.2.

Releases that contain the fix

Product Version	Action Plan / Mitigation	Update Released
11.4.x and later	Fix included in this release	11.4.1 - Released December 8, 2020
11.3.2 11.3.0 10.4.0	Apply 11.3.2 Hotfix 2 or later Apply 11.3.0 Hotfix 15 or later Apply 10.4.0 Hotfix 13 or later	11.3.2 - Released September 21, 2020 11.3.0 - Released September 21, 2020 10.4.0 - Released September 21, 2020
11.3.1 11.2.x 11.1.x 11.0.x	Upgrade to 11.3.2 ASAP and apply the hotfix	N/A¹
10.3.x or earlier	Option 1 - Upgrade to 10.4.0 ASAP and apply the hotfix Option 2 - Upgrade to 11.3.2 ASAP and apply the hotfix	N/A¹

¹ No updates are released for these versions. You must upgrade to a supported version that supports the administrative utility.

The SIEM upgrade files and SIEM Hotfix are available from the Product Downloads site, behind appropriate grant numbers.

NOTE: For information about the ESM Administrator thin client, see KB93413 - SIEM Flash EOL and ESM Administrator Thin-Client FAQs.

See the following links for information about upgrading to 11.5.x.

11.5.x:
- See Upgrade to ESM 11.5.x in the ESM Install Guide.
- Upgrading to 11.x best practices YouTube video.

After December 31, 2020, we won't support direct access to the remaining Flash parts of the ESM UI unless running one of the supported releases noted above.
We strongly recommend that you upgrade to a supported version that provides a secure method for accessing the remaining Flash parts of the ESM UI.

If you choose to maintain your own local install of Flash and a browser to support it, the product continues to function as it does today. We don't recommend this course of action, because of the potential security implications that might occur after December 31, 2020.

IMPORTANT: We're committed to helping our customers in this upgrade process. To let us help you develop and execute a plan to upgrade, contact your Sales Engineer or designated Support contact.

IMPORTANT: Distribution of Enterprise Security Manager in mainland China ceased as of September 15, 2020. The reason is potential vulnerabilities from independent software. The independent software is needed for distribution within mainland China for the next ESM release. For more information, see KB93376 - Change in availability of Enterprise Security Manager (ESM) in mainland China.

Problem

After January 1, 2021, you can't view the SIEM GUI. You can't use the ESM GUI to manage or upgrade your installation.

Solution

Perform the upgrade manually from the command line. Transfer the upgrade files using WinSCP.

Pre-upgrade checks:

Make sure you have adequate free disk space on the ESM:
- As a rule, all devices must have 55 GB of free space before an upgrade.
- ELM, ELMREC, and ENMELM require 150 GB of free space.
- VMs require a disk size of 500 GB, with at least 150 GB of free space.
Make sure that the ESM can communicate to all SIEM devices.

Manually upgrade SIEM:

NOTE: See also the Manually upgrading your ESM video tutorial on YouTube.

Download the update files.

IMPORTANT: To determine which update files you must download, view the Releases containing the fix table in the "Summary" field.
Open WinSCP and connect to the ESM.
Empty the /usr/local/ess/update folder.
Transfer the update files to the /usr/local/ess/update folder.
Stop the services on the ESM:
1. Type service cpservice stop and press Enter.
2. Type service dbserver stop and press Enter.
3. Type service snowflex stop-all and press Enter.
Restart the ESM:
Type reboot and press Enter.
On startup, the system finds the upgrade file and begins to apply it.

IMPORTANT: This process can take up to an hour.
Open a command-line session and confirm whether the upgrade is successful:
Type cat /etc/buildstamp and press Enter.

When the system is upgraded, install the update:

Log on to the Trellix Support ServicePortal.
Select your version of SIEM and download the latest hotfix.
View the installation instructions in the update release notes.

NOTES:
- Release Notes are available from the Product Documentation site.
- The update installation process stops the services, runs patch.pl, and then restarts the services.

Downloading and using the ESM Administrator application:

Log on to the SIEM GUI with any web browser in which Flash support is disabled.
In the HTML5 dashboard, click the dropdown at the top left and select System Properties.
You're redirected to a special download page for the ESM Administrator application.
Select Download ESM Administrator.
Ignore any warnings about potentially harmful files and accept the download.
Run the downloaded McAfee_Enterprise_Security_Manager_Setup_____.exe. Follow the prompts to install.

NOTE: The Windows Administrator must perform the installation for it to succeed. The installation fails when it's tried with non-administrative rights.
Click Finish and return to the web browser where you downloaded the ESM Administrator app earlier.
Click Launch.
You're prompted to allow the ESM Administrator application to start.

NOTE: We recommend that you enable the Always allow x.x.x.x to open links of this type in the associated app option.
Click Open ESM Administrator App.
You might see another pop-up warning about certificates, asking if they're trusted.
Contact your administrator regarding any certificate questions and security best practices.
The ESM Administrator application starts.

NOTE: If the user is previously logged in, it starts the user interface without requiring a logon.

IMPORTANT: To continue the SIEM upgrade on other devices:

After the ESM has been upgraded and patched, you can continue to upgrade your remaining SIEM devices.
Follow the upgrade procedures outlined in the version release notes for each remaining SIEM device.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

SIEM Flash Mitigation (unable to access the SIEM ESM UI)

Environment

Summary

Problem

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

SIEM Flash Mitigation (unable to access the SIEM ESM UI)

Environment

Summary

Problem

Solution

Affected Products

Languages:

Choose your region

Title

Title