topic VZ, 6.3 code is no in Network Security

Unable to update Antivirus pattern from Cisco CSC SSM

limlayhin — Tue, 12 Mar 2019 03:46:24 GMT

I have a Cisco ASA 5520, with Cisco ASA-SSM-CSC-10-K9. ASA version 8.4.3.

Since two days ago, automatic anti-virus pattern update for Cisco CSC SSM failed, error message as below:

AntiVirusPattern : Pattern Update: The download file was unsuccessful for ActiveUpdate was unable to verify security information. The local trusted info database is corrupted. Please contact Trend Micro technical support.. The error code is 62.

The license is valid and the subscription is expired on Sep 2014.

Any body encountered similar problem before?

Any body has Trend Micro Cisco CSC SSM helpdesk contact?

I can't find any Trend Micro info for Cisco CSC SSM.

Unable to update Antivirus pattern from Cisco CSC SSM

saimunpial — Mon, 17 Feb 2014 07:10:10 GMT

I got same error message from all CSC modules at different locations. I am going to contact with our local cisco support about it. Hope somebody from cisco should send a quick recovery for us as well.

Unable to update Antivirus pattern from Cisco CSC SSM

b.vanderburg — Mon, 17 Feb 2014 07:31:49 GMT

I've got the same message on CSC.

Unable to update Antivirus pattern from Cisco CSC SSM

Daniel Sleebos — Mon, 17 Feb 2014 07:41:45 GMT

Same problem since 15-02 on CSC

AntiSpamEngine : Pattern Update: The download file was unsuccessful for ActiveUpdate was unable to verify security information. The local trusted info database is corrupted. Please contact Trend Micro technical support.. The error code is 62.

AntiSpamPattern : Pattern Update: The download file was unsuccessful for ActiveUpdate was unable to verify security information. The local trusted info database is corrupted. Please contact Trend Micro technical support.. The error code is 62.

Unable to update Antivirus pattern from Cisco CSC SSM

cityofhayden — Mon, 17 Feb 2014 07:46:59 GMT

Same issue here. Same starting date and same error messages sent when it trys to update.

Unable to update Antivirus pattern from Cisco CSC SSM

limlayhin — Mon, 17 Feb 2014 07:58:31 GMT

Wow, so many people affected. Seems like it can be TrendMicro issues again.

I found previous issue in Cisco Forum

https://supportforums.cisco.com/message/4022033#4022033

The problem is, how do we contact Trend Micro?

Unable to update Antivirus pattern from Cisco CSC SSM

VDLSACHSEN — Mon, 17 Feb 2014 08:33:41 GMT

Same issue here, I've contacted my local CISCO-Support, still waiting for a solution.

I noticed, that the problem starts after a huge amount of SPAM-Mails of the well known "Paypal-kind", which all had malicious attachements, which were removed.

Regards, Jan

Unable to update Antivirus pattern from Cisco CSC SSM

markus.schwaiger — Mon, 17 Feb 2014 09:23:30 GMT

Same here. Opened TAC case.

Contacting TM should be Ciscos job as they are providing service and support for me.

Unable to update Antivirus pattern from Cisco CSC SSM

ischreiner — Mon, 17 Feb 2014 10:40:41 GMT

Same issue here

Unable to update Antivirus pattern from Cisco CSC SSM

Jim Phelan — Mon, 17 Feb 2014 11:13:47 GMT

Same issue here. Started with the AntiSPAM signatures then the AV ones

Unable to update Antivirus pattern from Cisco CSC SSM

CCO_Giesbers — Mon, 17 Feb 2014 11:55:49 GMT

We have the same problem since Friday.

Unable to update Antivirus pattern from Cisco CSC SSM

VincentBacher — Mon, 17 Feb 2014 13:36:29 GMT

Same issue at a customer's device. Opened a TAC case

Unable to update Antivirus pattern from Cisco CSC SSM

Tim Bottomley — Mon, 17 Feb 2014 13:50:00 GMT

Any updates on this issue?

Unable to update Antivirus pattern from Cisco CSC SSM

markus.schwaiger — Mon, 17 Feb 2014 13:51:11 GMT

Nope, still waiting...

Unable to update Antivirus pattern from Cisco CSC SSM

VincentBacher — Mon, 17 Feb 2014 13:55:53 GMT

just got this:

Action Plan:

This issue is seen because of RAM storage used to store pattern files while performing the updates, is not enough.

To resolve this, follow the below steps:

- Login to CSC via ASA CLI using command ‘session 1’. The username would be ‘cisco’ and the password would be the one which you use to login via GUI.

- Go to troubleshooting tools and then enable the root account.

- Now exit from here and login again via ‘session 1’ but this time, use the ‘root’ as the username and password as ‘cisco’.

- You would be prompted to change the password once logged in. Change it to any value of your choice.

- You would land at “-bash-3.00#” prompt. Copy and then paste the below command:

vi /etc/init.d/S01init_ISVW

- Add the RED line from the following output. It must be at this point in the file.

- Use ‘j’ to move cursor down.

case "$1" in

init) # for /loadrc to init before /sbin/init is started

dbg "init"

# ldconfig

dbg "ldconfig"

ldconfig 2>/dev/null

# sync kernel time with BIOS time (assume localtime as in ui_helper)

dbg "Set H/W clock"

/sbin/hwclock -s --localtime

# adjust linux kernel params

dbg "Adjust kernel params"

# adjust TCP windows size

echo "1" > /proc/sys/net/ipv4/tcp_adv_win_scale

echo "6144 262140 262140" > /proc/sys/net/ipv4/tcp_rmem

echo "6144 24576 196608" > /proc/sys/net/ipv4/tcp_wmem

# promote routing cache expiration

echo "30" > /proc/sys/net/ipv4/route/gc_interval

echo "60" > /proc/sys/net/ipv4/route/gc_timeout

# set core dump feature

echo 1 > /proc/sys/kernel/core_uses_pid

echo "/coredump/core-%e-%s-%p-%t.gz" > /proc/sys/kernel/core_pattern

# set system-related module difference

if [ -f $ISVW_HOME/script/ISmodulecfg ]; then

dbg "ISmodulecfg preinit"

sh $ISVW_HOME/script/ISmodulecfg preinit

else

warn "ISmodulecfg not found"

# move preset directory to prototype

[ -d $ISVW_HOME/prototype ] || warn "Unable to locate $ISVW_HOME/prototype"

# mount major tmpfs from fstab

for i in $TMPFS_DIRS; do

dbg "+ mount tmpfs $ISVW_HOME/$i"

[ -d $ISVW_HOME/$i ] || mkdir -p $ISVW_HOME/$i

mount $ISVW_HOME/$i || warn "Fail to mount $ISVW_HOME/$i"

[ -d $ISVW_HOME/prototype/$i ] \

&& cp -a $ISVW_HOME/prototype/$i/* $ISVW_HOME/$i

chown -R isvw.isvw $ISVW_HOME/$i > /dev/null 2>&1

done

# set permission for TMASE cache

chown isvw.isvw $ISVW_HOME/lib/mail/cache

# mount /coredump

dbg "Mount /coredump"

mkdir /coredump

mount /coredump || warn "Fail to mount /coredump"

mount none /opt/trend/isvw/lib/mail/AU_Data/AU_Temp -t tmpfs -o rw,size=100M

# create /var/run/isvw

dbg "Mount /var"

[ -d /var ] || mkdir /var

mount -n /var

mkdir -p /var/run/isvw

chown isvw.isvw /var/run/isvw

- Save the file by hitting 'ESCAPE' and then :wq

- Mount the tmpfs for the folder now using below command:

-bash-3.00# mount none /opt/trend/isvw/lib/mail/AU_Data/AU_Temp -t tmpfs -o rw,size=100M

- Confirm that the filesystem now has this mounted with the command df -h:

-bash-3.00# df -h

Filesystem Size Used Available Use% Mounted on

/dev/hda2 218.1M 174.0M 32.8M 84% /mnt/rw

/dev/hda2 218.1M 174.0M 32.8M 84% /dev

/dev/hda2 218.1M 174.0M 32.8M 84% /etc

/dev/hda2 218.1M 174.0M 32.8M 84% /home

/dev/hda2 218.1M 174.0M 32.8M 84% /lib/modules

/dev/hda2 218.1M 174.0M 32.8M 84% /opt

none 250.0M 0 250.0M 0% /opt/trend/isvw/temp

none 49.0M 20.8M 28.2M 43% /opt/trend/isvw/log

none 4.0M 0 4.0M 0% /opt/trend/isvw/quarantine

none 5.0M 0 5.0M 0% /opt/trend/isvw/queue

none 101.0M 104.0k 100.9M 0% /opt/trend/isvw/tmpfs

none 99.0M 33.6M 65.4M 34% /opt/trend/isvw/lib/mail/cache

none 98.0M 0 98.0M 0% /coredump

none 100.0M 0 100.0M 0% /opt/trend/isvw/lib/mail/AU_Data/AU_Temp

none 8.0M 220.0k 7.8M 3% /var

/dev/boot 18.6M 8.2M 9.4M 47% /boot

none 201.0M 40.0k 201.0M 0% /tmp

Once completed, please try to update pattern file and let me know in case of any queries.

Unable to update Antivirus pattern from Cisco CSC SSM

kamranga — Mon, 17 Feb 2014 14:05:22 GMT

Hi,

This is a know issue that seems to be affecting a lot of customers off late.

The root cause for the issue seems to be the inability of the CSC module to verify the signed pattern package that it downloads because the signer certificate has expired.

This has already been reported to Trend and there is a patch available for the same (6.6.1125.0.1140).

Please find below the release notes information for the same.

This hot fix resolves the following issue:
   
   Issue:    The ActiveUpdate module for Stargate supports 
             "root signed" certificates only. However, "root signed" 
             certificates will expire by March 2015. By that time, 
             every SSL server certificate must be issued by an 
             intermediate CA. Since the ActiveUpdate module does not 
             support intermediate CA certificates, all ActiveUpdate 
             updates will eventually fail.
             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   Solution: This hot fix updates the ActiveUpdate module to enable 
             CSC to support intermediate CA certificates.
 

 
 I would request you to open a TAC case so that the patch can be applied to the module.
 
 HTH
 Kamalesh

Unable to update Antivirus pattern from Cisco CSC SSM

Jim Phelan — Mon, 17 Feb 2014 14:05:25 GMT

What does this mean:

- Add the RED line from the following output. It must be at this point in the file.

I see nothing in RED in the directions and the part where it says: "it must be at this point in the file" is too clear.

Thanks,

Jim

Unable to update Antivirus pattern from Cisco CSC SSM

VincentBacher — Mon, 17 Feb 2014 14:47:21 GMT

just received a patch

testing

Unable to update Antivirus pattern from Cisco CSC SSM

Stephen Bush — Mon, 17 Feb 2014 16:24:55 GMT

I don't see the patch on Cisco website, did you have to recieve it direct from TAC?

Re: Unable to update Antivirus pattern from Cisco CSC SSM

VincentBacher — Mon, 17 Feb 2014 17:00:47 GMT

Its attached to my tac case

Sent from Cisco Technical Support iPhone App