Advisory: Sophos Anti-Virus for Linux may fail to update - Now Fixed

The issue notified in this advisory has now been fixed.

The fixed version has now been released, 14 May 2010.

You will be automatically updated to the new version via the Sophos WebCID, via EM Library, and via SUM, if you are using the recommended subscription.

If you configured SUM to use a fixed subscription of SAV 7.1.0 then it will also get updated automatically, but you will see a message in the Enterprise Console similar to the following:

Software Subscription "7.1.0" contained version 7.1.0 of platform Linux. This version is retired. Your subscription has been automatically upgraded.

Issue (now fixed)

On Wednesday 5 May, 2010, Sophos issued a maintenance release to Sophos Anti-Virus for Linux that may have caused client computers running Sophos Anti-Virus for Linux to stop updating.

We do not expect that all of our customers are affected by this issue. The customers who will be affected by this issue are only those who:

• have one or more computers running Sophos Anti-Virus for Linux that update from a parent Linux machine
  
  Computers that update from a CID (share) that is maintained by EM Library or Sophos Update Manager (SUM), or those that update directly from Sophos, are not affected.
  
• have already installed the maintenance release on the parent computer that shares its cache.
  
  This maintenance release from Sophos saw the version numbers change from version 6 to version 7. If you are subscribed to the recommended version of Sophos Anti-Virus for Linux on this computer, you are likely to be affected.
  
  If you are not sure whether or not you have installed this maintenance release, please see 'Check whether you are affected' under the What to do section below.

What to do

1. Check whether you are affected

If each of your Sophos Anti-Virus for Linux computers updates directly from Sophos, or from a CID/share maintained by EM Library or Sophos Update Manager, you will not be affected.

If you are unsure whether you are affected, on one of the computers that gets its updates from a parent computer:

1. Check to see what version of Sophos Anti-Virus for Linux the computer is running by running the following command:
   
   cat /opt/sophos-av/engine/version
   
   If the computer is running Sophos Anti-Virus for Linux version 7.1.0 then you are not affected by this issue.
   
2. If the computer is running Sophos Anti-Virus version 6.7.6 or lower, run the following command:
   
   /opt/sophos-av/bin/savupdate
   
   If this command fails it is likely that the computer is affected by this issue.

2. If your computers are affected

We are urgently working on a change to the updating code in SAV 7.1.0 which will fix this issue. We will replace the current packages in our databanks as soon as the new version is available.

A. If you use EM Library or Sophos Update Manager to manage your updates

If you are subscribed to the 'Recommended' Sophos Anti-Virus for Linux package, you can change your subscription in EM Library or Sophos Update Manager to roll your CIDs back to the previous version in order to keep your computers up to date.

• Using EM Library to roll back your subscription

1. Ensure that you are using the Central Databank
   1. Under Parent databank, ensure that you are using central.
   2. If you need to, Click 'Select Parent' and type (or select) es-central-3.sophos.com/update.
2. Open EM Library and click Select Packages.
3. Select SAV for Linux 'IDEs only' package 6.7.6.
4. For each Linux CID you need to fix, select the CID in EM Library and right-click Properties.
5. On the Package tab, select 'Allow selection of an alternative package' and change the package to be used to SAV for Linux 6.7.6.
   
   
   When you click OK, EM Library will download the new package and replace the version of Sophos Anti-Virus for Linux in your CIDs/shares. You should see your client computers updating within the hour.

• Using Sophos Update Manager to roll back your subscription

1. In Enterprise Console, select the 'Recommended' Sophos Anti-Virus for Linux subscription and click Edit.
2. Change the 'Linux' subscription from 'Recommended' to one of the subscriptions to Sophos Anti-Virus for Linux version 6.7.6.
   
   When you click OK, Sophos Update Manager will download the new subscription and replace the version of Sophos Anti-Virus for Linux in your CIDs/shares. You should see your client computers updating within the hour.

B. If you update directly from Sophos

If your client computers have access to the Internet, set their secondary update locations to Sophos in order to update until the fix is deployed.

If your client computers cannot access the Internet to update directly from Sophos, you will have to wait until the fix is deployed before your computers will begin updating again. Your computer will remain protected by Sophos Anti-Virus during this time, and we will deploy the fix with the utmost urgency in order to resume your updates.

About Sophos Anti-Virus for Linux version 7

Version 7 of Sophos Anti-Virus for Linux features an improved updating infrastructure that no longer requires all of the same files as Sophos Anti-Virus for Linux version 6.

The fixed version was released today 14 May 2010. Customers will automatically be updated to the new version via the Sophos WebCID, via EM Library and via SUM if they are using the recommended subscription.

If customers configured SUM to use a fixed subscription of SAV 7.1.0 then it will also get updated automatically but they will see a message similar to the following in SEC:

Software Subscription "7.1.0" contained version 7.1.0 of platform linux. This version is retired. Your subscription has been automatically upgraded.


Issue