Symantec Endpoint Protection Manager Hobbled by 2010 Date Bug

Symantec has revealed a bug in SEPM (Symantec Endpoint Protection Manager) that prevents new updates to AV/AS/IPS definitions. All such updates dated after December 31, 2009, 11:59 P.M. are rejected as “out of date.”

The affected products are:

• Symantec Endpoint Protection v11.x Product Line
• Symantec Endpoint Protection Small Business Edition v12.x Product Line

Note that Symantec Endpoint Protection clients are affected.

More detail is available in this KB article, and Symantec is responding to customers
on this discussion thread.

The last update, while dated, 12/31/2009, in fact contains definitions created through 1/2/2010. Symantec says that they will employ this same trick to keep updates coming until a fix is available. Updates have both a date and a revision number. The number of the last update is “rev.041″. Subsequent update will have the 12/31/2009 date and revision numbers greater than 041. Customers need not take any action to receive these updates. More information is in the KB article for “Rapid Release” users.

Hat tip to Toby Kohlenberg at the ISC.

About the Author: