000036711 - RSA NetWitness Endpoint Unassociated FLOATING CODE automatically whitelisted when not associated to a module

Document created by RSA Customer Support Employee on Sep 12, 2018
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000036711
Applies ToRSA Product Set: NetWitness Endpoint
RSA Product/Service Type: NetWitness Endpoint
RSA Version/Condition: 4.4.0.6
Platform: Windows
 
Issue[FLOATING CODE] as seen in tracking or summary data/scan data that is not module-associated is being whitelisted with other module code, which is incorrect behavior in the UI.

In order to see this issue, a gold image needs to be selected for whitelisting purposes so the associated modules are automatically whitelisted. This must also be set for automatic bias status assignment in the UI to see this in effect.
CauseThis is a bug that incorrectly sets both whitelisted floating code associated to modules AND unassociated floating code as whitelisted. Associated floating code should be whitelisted, unassociated [FLOATING CODE] should be ignored for whitelisting purposes.

This currently applies to gold images.
ResolutionThe resolution to this issue is to upgrade to 4.4.0.7, where the code fix is currently implemented.
NotesThere is no way to remove the whitelisting from the FLOATING CODE without removing gold image whitelisting as well.

Attachments

    Outcomes