topic Re: ISE UPgrade for CSCvd49829 in Network Access Control

ISE UPgrade for CSCvd49829

lnorman — Wed, 15 Mar 2017 18:58:04 GMT

Ok, WTH does this mean: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd49829

Releases 1.2, 1.3, 1.4 and 2.x are affected. A hot patch for these releases will be provided by the 18th of March.
The hot patch will only work on the latest release for each train. Customers need to upgrade to the latest release before applying the patch

Customers run 2.0 patch 4, is that the ‘latest release for that train’? Or are they demanding 2.2? Or 2.0.1? Or, we have to wait until March 18^th to find out?

Re: ISE UPgrade for CSCvd49829

Charlie Moreton — Thu, 16 Mar 2017 11:46:25 GMT

This means that you have to be running the latest patch for your version.

ISE 2.0 Patch 4

ISE 2.0.1 Patch 3

ISE 2.1 Patch 3

ISE 2.2 No Current Patches

You do NOT have to upgrade your version of ISE to install the Hotfix.

Re: ISE UPgrade for CSCvd49829

lnorman — Thu, 16 Mar 2017 17:29:09 GMT

Thanks Charles!

Lou

Re: ISE UPgrade for CSCvd49829

gtilburg — Mon, 20 Mar 2017 09:17:04 GMT

Hi,

March 18 has passed, where can the hot patch be found?

Thanks

Gert

Re: ISE UPgrade for CSCvd49829

Jason Kunst — Mon, 20 Mar 2017 17:37:15 GMT

what version of ISE?

Re: ISE UPgrade for CSCvd49829

Jason Kunst — Mon, 20 Mar 2017 18:45:07 GMT

seems like multiple threads about this same defect

see this one

Re: CSCvd49829

Re: ISE UPgrade for CSCvd49829

hslai — Mon, 20 Mar 2017 18:57:19 GMT

No need to open TAC cases for this. The patches will be available at CCO. Please see the ISE entry @ Apache Struts2 Jakarta Multipart Parser File Upload Code Execution Vulnerability Affecting Cisco Products to track its availability.

Re: ISE UPgrade for CSCvd49829

peng083411147 — Thu, 23 Mar 2017 02:36:46 GMT

My customer uses ISE version 1.2.1.198 ,is that the ‘latest release for that train’?

and I haven't installed all patch Version ,Do I need to install the latest patch?

thank you

cheer

Re: ISE UPgrade for CSCvd49829

Jason Kunst — Thu, 23 Mar 2017 15:20:55 GMT

Yes you will need to update to latest patch.

http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/release_notes/ise12_rn.html#pgfId-637191

Also work with them to get off ISE 1.2

http://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/eos-eol-notice-c51-736297.html

Re: ISE UPgrade for CSCvd49829

peng083411147 — Fri, 24 Mar 2017 06:17:22 GMT

HI Jason,

My customer uses ISE version 1.2.1.198 ,is that the ‘latest release for that train’?

Do I need to upgrade the version before I install install the latest patch?

THANK YOU

Re: ISE UPgrade for CSCvd49829

Jason Kunst — Fri, 24 Mar 2017 16:19:38 GMT

As stated before please refer to the release notes, patch 8 is the latest patch and yes you will need to install that, 1.2.1.198 is the version of ISE not the patch version, please again read the release notes

http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/release_notes/ise12_rn.html#pgfId-637191

Re: ISE UPgrade for CSCvd49829

peng083411147 — Sat, 25 Mar 2017 00:35:54 GMT

OK,Thank you for your patience

Releases 1.2, 1.3, 1.4 and 2.x are affected. A hot patch for these releases will be provided by the 24th of March.

but I don't find the hot patch in cisco.com

Re: ISE UPgrade for CSCvd49829

hslai — Sat, 25 Mar 2017 00:43:18 GMT

Refresh the browser? They are under Struts2-CVE-Fixes.

Re: ISE UPgrade for CSCvd49829

peng083411147 — Sat, 25 Mar 2017 12:00:34 GMT

execuse me,My customer users ISE version 1.2.1.198

but, I don't find the hot patch for this version?

only have Ftruts2Fix-1.3to14. and Struts2Fix-2.0to2.2.

So ,do I need to upgrade to version 1.3 before installing the patch?

Thanks

Re: ISE UPgrade for CSCvd49829

hslai — Sat, 25 Mar 2017 17:33:51 GMT

To patch ISE 1.2.x needs Cisco TAC assistant. Please open a TAC case, if not already done.

Re: ISE UPgrade for CSCvd49829

kahsieh — Mon, 27 Mar 2017 05:50:40 GMT

Hi hslai

So my customer is running 1.2.0.899. TAC can help find a patch, right?

We saw the "HotPatch-120-patch17-struts2-security-fix.tgz" two weeks ago on CCO but today it's gone...

Re: ISE UPgrade for CSCvd49829

Jason Kunst — Mon, 27 Mar 2017 20:53:52 GMT

please work through the TAC

Re: ISE UPgrade for CSCvd49829

hslai — Mon, 27 Mar 2017 22:57:03 GMT

Jason is correct. Customers would not be able to directly use the hot patch for ISE 1.2.x (1.2.0 and 1.2.1) so need our TAC to help applying it.