Signature Update S749 Alert

[wsulym]

After releasing signature update S749, we discovered a defect that significantly impacted the performance of the AnalysisEngine application running on the sensor. This defect is documented in CSCul00198. Having identified the root cause of the problem, we have provided a fix in signature update S750 and enhanced our test suite to detect this condition in future signature updates.  In order to avoid this issue do not upgrade to S749 (it is no longer available for download), instead, upgrade directly to S750. We apologize for any inconveniences this may have caused. 

[wsulym]

* Upgrade to S750 or later

[mhanson2004]

Hi,we were hit with the bug in Signature 749. It brought our ASA-5525 IPS down. I spent 2 hours with support tryign to figure out the problem and then downgrading the signatures to fix the problem.

Signature auto update is turned off currently and we are sitting at Signature Version 748. If I turn auto update back on will the IPS get the latest signature? Or is their a better way to get Signature Version 750 than letting auto update do it?

Thank you.

Mike

[wsulym]

How auto-update works is doc'd here:

http://www.cisco.com/en/US/products/sw/secursw/ps2113/products_tech_note09186a0080bd008f.shtml

IPS sig updates are cumulative, so if you were to turn auto-update back "on", the most current sig update pack should be selected from the servers for use - which is at the moment s751.

But you might want hands on control over the update so...

Sounds like you only have 1-2 devices to update... what you could do is grab the s750 or s751 update from here, install that manually via CLI or IDM, and *then* turn auto-update back "on":

http://software.cisco.com/download/navigator.html?mdfid=268439591&catid=268438162

here is direct to the current s751 update

http://software.cisco.com/download/release.html?mdfid=283674966&flowid=24482&softwareid=282549755&release=S751&relind=AVAILABLE&rellifecycle=&reltype=latest

[mhanson2004]

Thank you.

Mike