01-05-2018 08:59 AM - edited 02-21-2020 10:02 PM
Wednesday January 17, 2018
This document outlines compatibility details and product update information of AMP for Endpoints regarding the Microsoft Security Updates and Knowledge Base articles (KB4072699, KB4056892) released on January 3, 2018 to address the Meltdown and Spectre vulnerabilities (CVE-2017-5753, CVE-2017-5715, and CVE-2017-5754). This information is applicable to AMP for Endpoints Windows Connectors deployed on the public AMP Cloud and AMP Private Cloud environments.
This Microsoft Security Update comes with changes that may break compatibility with antivirus software. Microsoft has instituted a new requirement that security vendors validate compatibility with the security update before accepting the security update for installation.
With the complexity of the issue and number of vendors involved in the response, Cisco is providing the following guidance for customers to decide how to apply and upgrade their Cisco AMP for Endpoints software and underlying operating system. Customers must also review the applicability of any required hardware patches, which is not covered by this document.
Version Compatibility
The Cisco AMP for Endpoints engineering team has tested and verified compatibility with the following versions of the AMP for Endpoints software on the supported Microsoft operating systems.
Table 1 – Verified AMP for Endpoints Connector Versions
AMP Private Cloud |
Cisco AMP for Endpoints v5.1.11 |
Public AMP Cloud |
Cisco AMP for Endpoints v4.4.4 |
Cisco AMP for Endpoints v5.0.7 |
|
Cisco AMP for Endpoints v5.0.9 |
|
Cisco AMP for Endpoints v5.1.1 |
|
Cisco AMP for Endpoints v5.1.3 |
|
Cisco AMP for Endpoints v5.1.5 |
|
Cisco AMP for Endpoints v5.1.7 |
|
Cisco AMP for Endpoints v5.1.9 |
|
Cisco AMP for Endpoints v5.1.11 |
|
Cisco AMP for Endpoints v5.1.13 |
|
Cisco AMP for Endpoints v6.0.5 |
Table 2 – Verified Operating Systems
Microsoft Windows 7 SP1 |
Microsoft Windows 8.1 |
Microsoft Windows 10 |
Microsoft Windows Server 2008 R2 |
Microsoft Windows Server 2012 |
Note: Versions not listed are either no longer supported by the AMP for Endpoints Connector and/or not supported by Microsoft and the released Security Updates.
Complete resolution of the vulnerabilities may require hardware patches provided by each vendor. Cisco Engineering has validated on hardware from multiple hardware vendors, but you must validate for the specific hardware deployed within your environment.
Customer Action
Customers are required to upgrade to a version of the Cisco AMP for Endpoints Connector that has been tested and verified to be compatible with the Microsoft Security Update (see Table 1, Table 2). In addition, customers will need to manually set the required compatibility registry key detailed in Microsoft KB4056892 after verifying all third-party endpoint security software installed on the endpoint is compatible.
Once the compatibility registry key is set, the underlying operating system will allow the installation of the released Microsoft Security Updates.
Further information from Microsoft: Important information regarding the Windows security updates released on January 3, 2018 and anti-virus software
Customer Responsibility
Cisco recommends the following:
It is highly recommended customers validate and test in a staging environment with all endpoint security software deployed prior to setting the compatibility registry key in a production environment. Inadvertently setting the compatibility registry key on devices with third-party endpoint security software incompatible with the Microsoft Security Update may result in a Blue Screen of Death (BSOD).
Caveats and Considerations
Customers should be aware of the following:
Additional References
Talos Intelligence: Meltdown and Spectre
Project Zero: Reading privileged memory with a side-channel
This document will be updated with additional details as information is available and development continues.
Revision History:
2018-01-05.01 – Initial Release
2018-01-05.02 – Update to reflect details for AMP for Endpoints Windows Connectors.
2018-01-09.01 – Updated with AMP Private Cloud support details.
2018-01-10.01 – Updated cloud support and corrected OS version support to SP1 on Windows 7. Update additional references section.
2018-01-11.01 – Added Connector version support.
2018-01-15.01 – Added Connector version support.
2018-01-17.01 – Added Connector version support.
For computers that haven't had the patch installed, will AMP for Endpoints protect from the Meltdown and Spectre Intel chip flaw?
@fmpacisco Cisco Talos has released some guidance here: http://blog.talosintelligence.com/2018/01/meltdown-and-spectre.html
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: