Release Notes

Version 5.2.0.2 Sourcefire 3D System Release Notes 26
Issues Resolved in Version 5.2.0.2
• Resolved an issue where the system truncated text in long syslog
messages. (118816)
• Resolved an issue where some TCP connections detected by virtual
devices were not logged to the Defense Center. (118827)
• Resolved an issue with the formatting of text files sent with email alerts by
the Defense Center. (119267)
• Improved the IP defragmentation preprocessor to avoid a possible evasion
using packet fragments. (119531)
• Resolved an issue where TCP connections that were reset took a long time
to generate connection events. (119557)
• Resolve an issue where the system experienced issues with packet
reassembly when the port configuration in an applied intrusion policy
differed from the base intrusion policy. (119714)
• Improved functionality of access control rules with user conditions. (119962)
• Resolved an issue where intrusion rules using the
file_data keyword did
not drop traffic if Drop when Inline was disabled in the base intrusion policy.
(120156)
• Resolved an issue where the TCP stream preprocessor did not correctly
identify the server in HTTP traffic when detected midstream. (120170)
• Improved Teredo traffic decoding. (120292)
• Resolved an issue where, in some cases, intrusion events generated during
a network discovery policy apply were associated with incorrect security
zones. (120316)
• Resolved an issue with high availability configurations where you could not
change the secondary Defense Center to the primary role if the original
primary Defense Center was offline. (120327)
• Improved logging of Security Intelligence decisions to the syslog. (120564,
120565, 121050)
• Resolved an issue where, in some cases, URL filtering database updates
were not synchronized from the Defense Center to managed devices.
(120572)
• Resolved an issue where access control policy apply failed when the default
action was Block All Traffic and the HOME_NET variable was
any. Because
this combination is invalid, the system now warns you if you attempt to
configure it. (120578)
• Resolved an issue where fragmented IP traffic that would normally match a
Trust access control rule and pass without further inspection was instead
evaluated by the intrusion policy associated with the default action.
(120734)
• Resolved an issue where, in some cases, changing the dashboard widget
time range caused the widget to display incorrect event statistics. (121009)