Carbon Black App Control Windows Agent 8.9.6 Release Notes

Carbon Black App Control 8.9.6 | October 1, 2024 | Build 8.9.6.1649.974 Check for additions and updates to these release notes.

Caution:

Starting with the 8.9.4 App Control server, valid signing certificates are required for all files contained in Windows App Control agent installation packages. In February 2023, the signing certificate used to validate SHA-1 MSI's in the 8.9.4 server expired, which prevents any future Windows App Control agent installation packages from being properly validated and installed with this server version.

We recommend both customers who do and do not use Windows XP/2003 on 8.9.4 server upgrade to 8.9.6 server to ensure there are no issues with future release installations. The 8.9.6 Server contains an updated SHA-1 signing signature required to validate future installation packages of the Windows App Control agent.

Customers who do not wish to upgrade to 8.9.6 server must manually apply the new SHA-1 signing certificate to prevent these issues from occuring. You can download this new signing certificate here.

What's New

The 8.9.6 Windows Agent Release Notes provide information for users upgrading from previous versions and for users new to Carbon Black App Control. This is a maintenance release.

This release fixes two issues with App Control operability with Windows 11 24h2. Changes in the latest operating system can:

• Impact the security efficacy of App Control when the agent is enforcing protection on Windows 11 24h2 systems

• Introduce the risk of process deadlocks

Important:

All customers must upgrade their App Control Windows Agents to version 8.9.6 prior to upgrading their Windows systems to Windows 11 24h2.

• Added support for Win11 24H2

• Updated Third Party Libraries

  The following third party libraries were updated in this release:

  • TinyXML updated from 3.0 to 10.0

  • SQLite SEE updated from 3.38.2 to 3.44.2

  • zlib updated from 1.2.13 to 1.3.1

  • Yara updated from 4.0.2 to 4.0.5

  • Boost updated from 1.59 to 1.80

Downloading the Software

You can access all Carbon Black App Control software by logging onto the Broadcom customer portal, navigating to the Downloads section, and searching for the software you need.

Important:

You can use this LINK for Carbon Black App Control Windows Agent 8.9.6.1649.974.

The SHA-256 for Carbon Black App Control Windows Agent 8.9.6.1649.974 is:

0cd62c3077377bf5889f2e1c7fa0831bf6d88523a75fd8dd04120958ea30397b

Resolved Issues

There were no additional issues resolved in this release.

Known Issues

• EP-1201: On Windows 2003 x64, you may see a health check reporting improper classifications immediately after installation

  This should go away after roughly fifteen minutes.

• EP-1682: Carbon Black App Control does not support in-container enforcement

  Users can use the Microsoft Edge Virtualization feature, but Carbon Black App Control will not enforce rules within the container. It will, however, enforce rules on anything that breaks out of the sandbox.

• EP-2393: The appearance in the console of block and report events related to the Ransomware rapid config may be delayed by a minute or more

• EP-5483: The agent currently tracks all the extracted content from the Windows 10 WIM image in the temp directory

  A rule to ignore these writes is not yet functioning properly.

• EP-5498: In some cases, the agent will report an empty installer for a given file

  The file will still be correctly approved or not, as expected on the endpoint. Only reporting of the source installer is failing, not enforcement of relevant rules.

• EP-6104: Cleanmgr.exe is a windows utility process that runs occasionally and will copy files to the "temp" folder in order to run analysis on them

  These files are only copies of other files already on the machine and cleanmgr.exe never executes them.

• EP-6106: An installation of a new Carbon Black App Control Agent on the latest version of Windows 10 can result in a health check error due to a miscalculation of how many events the agent should send to the Carbon Black App Control server

  This problem disappears after a reboot.

• EP-6107: After upgrading agents on Windows XP systems, it is possible to see signature error events stating that the installer download failed

  The upgrade should be successful and there should not be any impact on the upgrade process.

• EP-6197: Occasionally the agent will complain about metadata not being properly populated and trigger an Error

  The Error implies a mismatch in expectation but is not expected to break functionality of the agent and can be ignored.

• EP-6982: Carbon Black App Control does not support NTFS reparse points as exclusion paths and they should not be used with kernelFileOpExclusions configuration rules

  Reparse points include such objects like symbolic links, directory junction points and volume mount points.

• EP-10542: When uninstalling the agent, a Carbon Black App Control Agent dialog displays informing the user that certain applications must be closed before continuing the installation

  This informational message is caused by a known msiexec defect.

  Important: This could occur during a removal of the agent using "add/remove programs" or during an upgrade of the agent if you are using 3rd party software or a manual upgrade using msiexec. Customers that perform agent upgrades from within the Carbon Black App Control Admin console are not affected. When uninstalling the agent or performing a manual upgrade, or upgrade using 3rd party software, you can suppress this dialog with the additional msiexec command line argument "/qb-". This will disable modal dialog during manual uninstalls and upgrades.

  The example below shows how to manually uninstall the Carbon Black App Control agent with the /qb- argument:

  msiexec /x {EnterGUIDHere} /qb-

  This issue is not new to the Windows agent and possibly affected customers on earlier releases. A long term fix will be implemented in a future release.

• EP-13016: SDHC Cards are not supported.

• EP-14223: When using 8.6.x servers, policy and enforcement levels may not display correctly for 8.6.x Windows agents installed on Windows 11.

  The 8.7.0+ App Control Server and 8.7.2+ Windows Agent resolves this issue.

• EP-18203: In 8.9.0 and greater versions of the Windows Agent, the following health check on Windows XP and 2K3 may be displayed:"Severity[Low]: c:\program files\bit9\parity agent\parity.exe is signed but could not check revocation: Error[800B010E]"

  Due to potential SHA-1 collisions, certificate issuers no longer issue SHA-1 certificates. As a result, we've issued our own SHA-1 certificate and we do not have a way to issue CRLs (certificate revocation lists). The issue does not occur on operating systems that fully support SHA-256.

• EP-18204: The signature information of App Control binaries on Windows XP and Windows 2003, may display the following error:"A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file".

  This is due to Windows XP and WIndows 2003 not fully supporting SHA-256 signatures. The timestamping server that we use only signs with SHA-256 or later, and so the OS cannot verify that the file was signed in the validity period of the Carbon Black signing certificate.

• EP-18508: Users may only see one notifier display when an instance of process hollowing is detected and blocked. In this case, two notifiers should display, one blocking the hollowing process and one blocking the hollowed process.

  Even though one notifier displays both processes are still blocked.

• EP-19509: Custom rules are not enforced on WinXP when the DFS Server is from another domain

  Automatic DFS mapping requires the active user to have permissions on the DFS server. Entering separate credentials in explorer is not sufficient.