Field Notice: FN - 70318 - Firepower Software - Expired Certificate Authority for Clam AntiVirus Might Reduce Efficacy of Local Malware Analysis - Software Upgrade Recommended

Available Languages

Updated:April 18, 2019

Document ID:FN70318

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Revision History

Revision	Publish Date	Comments
1.0	06-Dec-18	Initial Release
1.1	18-Apr-19	Updated the Workaround/Solution Section

Products Affected

Affected OS Type	Affected Software Product	Affected Release	Affected Release Number
NON-IOS	Firepower Management Center Software	6.0	6.0.0.0, 6.0.0.1, 6.0.1, 6.0.1.1, 6.0.1.2, 6.0.1.3, 6.0.1.4
NON-IOS	Firepower Management Center Software	6.1	6.1.0, 6.1.0.1, 6.1.0.2, 6.1.0.3, 6.1.0.4, 6.1.0.5, 6.1.0.6, 6.1.0.7
NON-IOS	Firepower Management Center Software	6.2	6.2.0, 6.2.0.1, 6.2.0.2, 6.2.0.3, 6.2.0.4, 6.2.0.5, 6.2.0.6, 6.2.1, 6.2.2, 6.2.2.1, 6.2.2.2, 6.2.2.3, 6.2.2.4, 6.2.2.5, 6.2.3, 6.2.3.1, 6.2.3.2, 6.2.3.3, 6.2.3.4, 6.2.3.5, 6.2.3.6, 6.2.3.7

Defect Information

Defect ID	Headline
CSCvm81052	local malware detection updates not downloading to FMC due to invalid certificate chain

Problem Description

An expired certificate for Clam AntiVirus (ClamAV) might cause updates from the updates.vrt.sourcefire.com server to fail, which reduces the security efficacy of the Network Advanced Malware Protection (AMP) feature.

Background

Cisco Firepower software uses a Certificate Authority (CA) to validate ClamAV signature updates for Local Malware Detection and File Pre-Classification from the updates.vrt.sourcefire.com server. The certificate for ClamAV expired on 2018-08-29 and might affect the security efficacy of the Network AMP feature. A revised ClamAV certificate must be installed on Firepower security platforms that run Firepower Software Version 6.0.0 or later.

Problem Symptom

ClamAV updates for both Local Malware Detection and File Pre-Classification for the Network AMP feature of the Firepower solution will fail to update, which reduces the security efficacy of the appliance.

Workaround/Solution

Apply the Firepower Software Hotfix 6.2.0.999 in order to resolve the CA certificate issue for affected platforms.

In order to resolve the issue without an upgrade to the Firepower software, complete these steps to manually import the updated ClamAV certificate and enable signature updates. Do not use this workaround when you use CC Mode. Instead, upgrade to Firepower Software Version 6.2.3.9 or later.

Enter sudo su - in order to elevate to root.
Enter mv /etc/sf/keys/sandbox/cacert.pem /etc/sf/keys/sandbox/cacert.pem.bak in order to back up the current certificate.

Create a new certificate file.

Enter vim /etc/sf/keys/sandbox/cacert.pem.
Press the i key in order to enter editing mode.

Copy and paste this updated certificate into the file.

Press the ESC key in order to exit editing mode.
Enter :wq in order to save the file and exit.

Enter pmtool restartbyid CloudAgent in order to restart the service to use the updated ClamAV certificate.

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

Receive Email Notification For New Field Notices

Cisco Notification Service—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.