Hello, Cisco IronPort has seen an increase in spam and other unwanted emails originating  from IP addresses registered with and belonging to Yahoo! This spam originates mainly from Yahoo! Mail and Yahoo! Groups email addresses. This increase in spam has been reported by our customers through end user complaints as well as an increase in spam trap reports. The result has been a drop in the reputation of up to 5% of Yahoo’s IPs from good to the neutral range (between -2 and +1). Cisco IronPort recommends that ESA customers throttle incoming connections from IPs with a neutral reputation score once the maximum number of connections has been reached. This results in Yahoo! IPs being throttled with the comment “Too many connections this hour”.  Several customers have complained about not receiving emails from Yahoo! based not on Cisco IronPort intentionally blocking  Yahoo’s IPs, but instead providing a reputation score based on the complaints we have seen and the threat of missed spam to our customers globally. How can I avoid throttling Yahoo mail? Cisco IronPort Email Security Appliance can be configured to not throttle mail by creating custom mail flow policies and sender groups for Yahoo domain mail servers (.yahoo.com). More information on how to create custom mail flow policies and sender groups can be found in Cisco IronPort Email Security Appliance - Configuration guide (The Host Access Table (HAT): Sender Groups and Mail Flow Policies): http://www.cisco.com/web/ironport/index.html Note: Accepting mail from domains or mail servers with low Senderbase reputation may lead to increase in missed Spam and potentially cause performance issues. What steps has Cisco taken to help with this issue? We have been communicating with the appropriate contacts at Yahoo! regarding their outbound mail issue and we have been assured that they’re working on it. Cisco IronPort has been providing Yahoo! with reports and any information that could help Yahoo! get to the bottom of this. While Yahoo! has told us that they are aware of this and are working on it, we do not have the specific details of steps Yahoo! has taken. We will continue to work with Yahoo! to help them resolve this issue. Cisco IronPort has been actively updating rules numerous times a day against spam received from Yahoo! This should help against some of the missed spam issue if the customers were to take steps to accept all emails from Yahoo! and run IronPort AntiSpam on them. We request that customers continue to submit spam messages to spam@access.ironport.com or use one of our plugins (MS Outlook or Lotus Notes) to report these missed spam emails. Best Regards, Cisco IronPort Customer Support ... View more

Hello, Cisco IronPort customers that use local AsyncOS upgrade instead of dynamic upgrades will be unable to perform upgrades at this time. We are currently working on a solution that could be implemented by early next week. Note: * By default, Cisco IronPort appliances are configured to use “dynamic upgrades” * Service updates are not interrupted because of this issue How to verify, if you use "dynamic upgrades"? Please use CLI command "Updateconfig" and verify that "IronPort AsyncOS upgrades" are fetched from "IronPort Servers". In the interim, customers with local upgrades can take advantage of dynamic IronPort upgrades. How to perform AsyncOS upgrades? Please refer the AsyncOS Configuration guide available on Cisco.com or help section from WebUI of appliance: System Administration > Upgrading AsyncOS Regards Kishore ... View more

Hello, Cisco IronPort customers that use local AsyncOS upgrade instead of dynamic upgrades will be unable to perform upgrades at this time. We are currently working on a solution that could be implemented by early next week. Note: * By default, Cisco IronPort appliances are configured to use “dynamic upgrades” * Service updates are not interrupted because of this issue How to verify, if you use "dynamic upgrades"? Please use CLI command "Updateconfig" and verify that "IronPort AsyncOS upgrades" are fetched from "IronPort Servers". In the interim, customers with local upgrades can take advantage of dynamic IronPort upgrades. How to perform AsyncOS upgrades? Please refer the AsyncOS Configuration guide available on Cisco.com or help section from WebUI of appliance: System Administration > Upgrading AsyncOS Regards Kishore ... View more

Dear Cisco Customer, We are currently experiencing some issues with Cisco Registered Envelope Service that might prevent sending and receiving of secure email messages. Our engineering team is actively investigating the issue and we hope to restore the service at the earliest. Please feel free to contact your authorized service provider, if you have any additional questions. Thank you for your patience, while we work to resolve the issue. Best Regards, Cisco Registered Envelope Service ... View more

The Cisco Registered Envelope Service (CRES) will undergo a Network maintenance outside the usual scheduled maintenance window. We thank you for your patience while we work to ensure the stability and performance of our hosted infrastructure. Maintenance Duration: Saturday, October 30th from 18:00 - 20:00 PST (Sunday, October 31st 02:00:00 - 04:00:00 UTC) Impact: We do not anticipate any downtime during the maintainence. All Cisco Registered Envelope Services will function as desired. Note: This is in addition to our regularly scheduled maintenance window from 10 AM to 11 AM Pacific Time on the second Saturday of every month. Complete Terms of Service - https://res.cisco.com/websafe/termsOfService   are available on the CRES web site. Please feel free to contact Cisco IronPort Customer Support if you have any additional questions. Thank you for choosing Cisco IronPort Security Products. Best Regards, Cisco IronPort Customer Support ... View more

Please see attached Cisco Security Bulletin about the recent Email Worm "Here You Have" The Bulletin includes information about the Email Worm, Cisco Protection and FAQ's. <You can find the snippet of the bulletin below> Background Information: On  September 9th, an email worm with subject line "Here You Have" began  circulating, with widespread media attention soon following. In  actuality, the email worm contained a significant flaw that ensured an  extremely short 'time to life'. The actual email worm binary was sent as  a link contained in the body of the email. What are the characteristics of the email message? Email characteristics vary, although the subject line (Here You Have) is constant. Examples of the email message text include: Hello: This is The Document I told you about,you can find it Here. <link to worm binary> Please check it and reply as soon as possible. Cheers, ‐‐ and ‐‐ Hello: This is The Free Dowload Sex Movies,you can find it Here. <link to worm binary> Enjoy Your Time. Cheers, Does Cisco detect and block this attack? Yes. The Cisco Web Security Solutions detects and blocks this worm. First encounter/block was on 09‐sep‐10 15:59:20 GMT. The Cisco Email Security Solutions detects and blocks the email spam, as of 09‐Sep‐10 17:51:00 GMT. Safeguards: Cisco  continues to provide proactive protection from Email and Web‐based  threats,including the latest “Here You Have” Email Worm, in all of its  Email and Web Security products and services. Cisco IronPort Email Security Appliance (ESA): Our Email Security Appliances,running Cisco IronPort Anti‐Spam, blocked  this threat over email within minutes of the worm campaigns’ start,  providing excellent protection from all variations of this worm. Cisco IronPort Cloud Email Security Services: Similarly Cisco IronPort Anti‐Spam also protected our Cloud Email Security customers within minutes of the worm’s outbreak. Cisco ScanSafe Web Security Products: ScanSafe customers are provided protection through Outbreak  Intelligence using content analysis techniques that block this threat  based on the payload as well as the redirections involved in reaching  that payload. Cisco IronPort Web Security Appliance (WSA): Web security can be effective in stopping the propagation and operation  of HYH Email Worm. The S‐Series Secure Web Gateway, running Web  Reputation Filters, has shown to be extremely effective in mitigating  risk on the Web vector by blocking the URL associated with the HYH Email  Worm. Customers with Web Reputation Filters are receiving this  protection. ... View more