Re: Problem with CSPM 3.0(5)S23 IDSM

d.twaddle · ‎08-15-2002

After installing the latest CSPM with (CSPM-2.3.3i-S29-exe.zip) to support an IDSM with 3.0(5)S23, the version 3.0(5)S23 is not selectable in the "Sensor Version" pulldown in CSPM.

If you view the sig.dat file for CSPM-2.3.3i-S29-exe.zip only the following versions for IDSM are available:

2.5(0)S0 IDSM

2.5(1)S0 IDSM

2.5(1)S1 IDSM

2.5(1)S2 IDSM

3.0(1)S4 IDSM

3.0(2)S4 IDSM

3.0(2)S6 IDSM

3.0(2)S10 IDSM

3.0(3)S10 IDSM

3.0(3)S12 IDSM

3.0(3)S13 IDSM

3.0(4)S20 IDSM

3.0(4)S21 IDSM

3.0(4)S22 IDSM

3.0(4)S23 IDSM

3.0(4)S24 IDSM

3.0(4)S25 IDSM

3.0(4)S26 IDSM

3.0(4)S27 IDSM

3.0(4)S28 IDSM

3.1(2)S29 IDSM

Where is 3.0(5)S23 IDSM?

I thought this may be an isolated problem with this signature release so I went and checked the older versions of CSPM.

CSPM-2.3.3i-S28-exe.zip supports up to 3.0(4)S28 IDSM

CSPM-2.3.3i-S27-exe.zip supports up to 3.0(4)S27 IDSM

CSPM-2.3.3i-S26-exe.zip supports up to 3.0(4)S26 IDSM

CSPM-2.3.3i-S25-exe.zip supports up to 3.0(4)S23 IDSM

CSPM-2.3.3i-S24-exe.zip supports up to 3.0(4)S23 IDSM

CSPM-2.3.3i-S23a-exe.zip supports up to 3.0(4)S23 IDSM

CSPM-2.3.3i-S22-exe.zip supports up to 3.0(4)S21 IDSM

CSPM-2.3.3i-S21-exe.zip supports up to 3.0(4)S21 IDSM

Still no mention of 3.0(5)S23 IDSM in any release.

Any help will be appreciated.

marcabal · ‎08-15-2002

I've sent an email off to the Signature Update team and they will have to correct this in the next CSPM update.

In the meantime can you try to use the 3.0(4)S23 entry?

If this works, then use the 3.0(4)S23 entry as a workaround until CSPM can be updated with the correct entry. There should be no functional difference in what CSPM can configure between 3.0(4)S23 and 3.0(5)S23.

NOTE: Originally S23 was going to be released as a 3.0(4)S23, but then other bug fixes, and ssh were added requiring us to increaes the number to 3.0(5)S23.

Marco

ddinh · ‎08-15-2002

I had the same problem with a different version but I resolved it by installing the CSPM update first, using the Signature Update Wizard (not selecting any version on the first screen - click next - check on "Load CSPM Sensor Signature Update File" - browse for the "html" folder of your extracted update).

Then run the update ont he IDSM.

Now run the Signature Update Wizard again. At this time the correct version should populate. Highlight it and click "Query Sensor".

Hope this helps.

Cheers,

Damien Dinh

d.twaddle · ‎08-15-2002

I have had a similar problem with what you just described before however, this is not the same. This one is a direct result of the signature not being in the data file. I have selected 3.0(4)S23 IDSM in the CSPM for the time being (as suggested) and will wait for the next release.

d.twaddle · ‎08-15-2002

My reply above was somehow duplicated. This msg was deleted.

lathian · ‎08-16-2002

I have the same problem. I just choose 3.0(4)S23 IDSM for now. Hope it will fix in the next update. By the way, does anyone see this warning message under Command tab.

WARNING MESSAGES

Specified IDS Sensor Version 3.0(4)S23 IDSM is not an exact match to

a supported version. All features may not be supported

Thanks

marcabal · ‎08-16-2002

That message is a warning and can be safely ignored.

It mainly just lets you know that CSPM may not be able to configure all the new features (other than signatures) in the sensor version you are using.

For example: CSPM can not configure the ssh server that is new in 3.0(5)Sx (the ssh server has to be configured though the IDSM cli).