Vulnerability reported in Symantec Anti-virus

Is it possible to apply the patches locally to managed
clients, or 
does it have to come from the management server? My initial
tests 
suggest that the patches will not run locally if the machine
in 
managed.

Graham

--
Graham Patterson, System Administration
Dept. of Economics, UC Berkeley (510)643-5397



------------------------------------------------------------
------------
The following was automatically added to this message by the
list server:

For information about Micronet, including subscribing to
or unsubscribing from its mailing list and finding out
about upcoming meetings, please visit the Micronet Web site:
<http://micronet.be
rkeley.edu/>.

Hi Graham,

On Tuesday 30 May 2006 11:06, Graham A. Patterson wrote:

> Is it possible to apply the patches locally to managed
clients, or
> does it have to come from the management server? My
initial tests

The Symantec installation instructions imply that either
should work. I have 
only tried doing a local install on unmanaged clients. The
Client Remote 
tool invokes an msiexec command:

=======
msiexec.exe /p SCS_3.1.0.401_AllWin_EN.msp /qn REINSTALL=ALL

REINSTALLMODE=omus /l*v c:\patchlog.txt
=======

which should also work locally, as far as I can tell.

> suggest that the patches will not run locally if the
machine in
> managed.

What error are you seeing?

--Karl

------------------------------------------------------------
------------
The following was automatically added to this message by the
list server:

For information about Micronet, including subscribing to
or unsubscribing from its mailing list and finding out
about upcoming meetings, please visit the Micronet Web site:
<http://micronet.be
rkeley.edu/>.

Karl,


Going from 10.1.0.394 to any of ...396, 400, 401 gives:

"The upgrade patch cannot be installed by the Windows
Installer 
service because the program to be upgraded may be missing,
or the 
upgrade patch may update a different versions of the
program. Verify 
that the program to be upgraded exists on your computer and
that you 
have the correct upgrade patch."

The .msp program and the VPREMOTE.DAT file reside in the
same network 
directory. I am running with an account with local
administrative 
rights, and write permission on the network share (actually
OU admin 
rights).

There is no suggestion that this is location sensitive, or
that some 
other program is needed.

I have also tried copying the files to a local location with
the same 
effect.


Just to make things interesting, the Client Remote tool
sequence does 
not match the instructions - I suspect I need to update the
management 
server in order to do a remote push. Since I only have 10 or
so 10.x 
series installations I was hoping to do the clients first.


Graham

--
Graham Patterson, System Administration
Dept. of Economics, UC Berkeley (510)643-5397


------------------------------------------------------------
------------
The following was automatically added to this message by the
list server:

For information about Micronet, including subscribing to
or unsubscribing from its mailing list and finding out
about upcoming meetings, please visit the Micronet Web site:
<http://micronet.be
rkeley.edu/>.

On Tuesday 30 May 2006 11:31, Graham A. Patterson wrote:

> Going from 10.1.0.394 to any of ...396, 400, 401 gives:

The only patches that should work for 10.1.0.394 are 
either "scs_3.1.0.400_allwin_en.zip" (to give
MP1) 
or "SCS_3.1.0.396_AllWin_EN.zip" (to give PP1).
I don't recommend the 
latter since then the MP1 patches are missed. Once you are
at the "400" 
level, then going to "401" gives the most recent
security fix.

Nevertheless, if you cannot apply a patch because of the
error you cite, you 
can either enable detailed logging for the msiexec installer
(as per the 
VPREMOTE.DAT command) and try to troubleshoot, or, more
likely, just 
uninstall and reinstall 3.1 itself to try to correct the
issue.

In my testing, I had some problems with going from 394 to
400 on one Dell 
system (it seemed to hang near the end of the patching
process), but by 
starting with a clean 3.1 install and then canceling the
hung patch process 
by killing running Symantec processes other than the msiexec
ones and then 
reapplying the same patch, I eventually got it go.
Minimizing any processes 
resident in memory and performing the patch just following a
reboot also 
seemed to help.

--Karl

=======
> "The upgrade patch cannot be installed by the
Windows Installer
> service because the program to be upgraded may be
missing, or the
> upgrade patch may update a different versions of the
program. Verify
> that the program to be upgraded exists on your computer
and that you
> have the correct upgrade patch."
>
> The .msp program and the VPREMOTE.DAT file reside in
the same network
> directory. I am running with an account with local
administrative
> rights, and write permission on the network share
(actually OU admin
> rights).
>
> There is no suggestion that this is location sensitive,
or that some
> other program is needed.
>
> I have also tried copying the files to a local location
with the same
> effect.
>
>
> Just to make things interesting, the Client Remote tool
sequence does
> not match the instructions - I suspect I need to update
the management
> server in order to do a remote push. Since I only have
10 or so 10.x
> series installations I was hoping to do the clients
first.


------------------------------------------------------------
------------
The following was automatically added to this message by the
list server:

For information about Micronet, including subscribing to
or unsubscribing from its mailing list and finding out
about upcoming meetings, please visit the Micronet Web site:
<http://micronet.be
rkeley.edu/>.