There is a vulnerability in the SecureDoc Windows

SecureDoc Enterprise Server

Release Notes

Product Version: 9.1 HF4

Published  April 15^th, 2024

SecureDoc Support

WinMagic strongly recommends that you install the most recent software release to stay up-to-date with the latest functional improvements, stability fixes, security enhancements and new features.

Please visit Knowledge Base Article 1397 for more information on End of Life and End of Support timelines for SecureDoc software releases.

About This Release

This document contains important information about the current release. We strongly recommend that you read the entire document.

Recommended – WinMagic recommends this service release for all environments. Apply this update at your earliest convenience.

NOTE:  End of Life date for Hotfixes is the same as the Version or Service Release upon which they are based.

Download the latest release notes for each version listed within Knowledge Base Article 1756.

System Requirements

If using features that use the TPM (e.g., MagicEndpoint, or other TPM-based authentication such as TPM protection for Key Files), devices must have TPM 2.0 – TPM 1.2 or earlier are not supported.

For server and client system requirements: https://www.winmagic.com/support/technical-specifications

For supported devices, drives, smartcards, and tokens: https://www.winmagic.com/device-compatibility

Note:  It is strongly recommended to initially install Full-Text Indexing feature (Full-Text Search) into the Database Engine, before performing an SES installation.

More information is available here: http://msdn.microsoft.com/en-us/library/ms143786(v=sql.100).ASPX

During the installation of SES, if Full-Text Indexing has not been installed, a message will appear indicating the absence of the Full-Text Indexing. This message will not allow the user to stop the installation of SES which will require retrofitting Full-Text Indexing into an existing SQL Server.

Note:  Use of the SES Console will require the user to have at least local admin rights on the server or client device (e.g., Admin desktop) on which it runs for the console to function properly.

Client OS Support

Devices utilizing MagicEndpoint authentication must have Windows 10 or 11 – Windows 7 is not supported.

For a detailed view of which specific versions of SecureDoc are supported under various versions of Windows, macOS or Linux:  See: https://www.winmagic.com/support/technical-specifications

Mobile Token-based authentication using Bluetooth is not supported on any pre-Windows 10 Operating Systems

The KnownConfigs.XML File

Customers are strongly advised to download the most current KnownConfigs.XML file, then replace the current version (if older) in the SES Application folders and

Installation Packages.

WinMagic strongly recommends that you seek out the most up-to-date version of the KnownConfigs.XML file and incorporate it into your SES implementation on a regular basis (e.g., monthly). This will help ensure your SES Version will take advantage of new client installation override settings that have been added since the version of the KnownConfigs.XML file that came with your version of SES. This will improve installation success on any new device makes/models you might purchase since installing SES, utilizing the new special settings available in newer versions of this file.

Customers are advised to look to the SecureDoc Knowledge Base for a link to the available KnownConfigs.XML files, then check that document (e.g., on a monthly basis) for updates to this file, then use the new version to replace all versions of the KnownConfigs.XML file in their SES Implementation folder structure. For example:

1. Position Windows Explorer to: c:\Program Files(x8)\WinMagic\SDDB-NT, then

2. Search for files like *.xml.

3. Sort the resulting search list by name

4. In each directory where a KnownConfigs.XML file is found, replace it with the new one that you have downloaded from the WinMagic Knowledge Base article.

Additional information can be found here: Installing or updating the KnownConfigs.xml file (Applies to SES from Version 7.5 onward).

The latest versions of the KnownConfigs.XML files can be found at the following links:

• SecureDoc Device KnownConfigs.XML File for SES V8.2 And Later- Download the

latest version of this here: https://na80.salesforce.com/articles/Service/SecureDoc-Device-KnownConfigs-XML-File-for-SES-V8-2-Download-the-latest-version-of-this-here

• SecureDoc Device KnownConfigs.XML File for SES V7.5 - Download the latest version of this here: https://na80.salesforce.com/articles/Service/SecureDoc-Device-KnownConfigs-XML-File-for-SES-V7-5-Download-the-latest-version-of-this-here

The contents of the KnownConfigs.XML file is reserved to be developed and advanced by WinMagic solely. While customers might consider enhancing it, WinMagic cannot be held responsible for issues that might arise from such modifications and may (at its sole discretion) levy an additional support charge to any customers that encounter support issues that can be traced back non-sanctioned customer-initiated changes to KnownConfigs.XML.

WinMagic welcomes customer ideas and suggestions on how KnownConfigs.XML can be extended and improved, but WinMagic reserves the sole right to test, approve and to publish any changes to KnownConfigs.XML that it deems to be in the broader customer interest, and makes no commitment to act upon or publish all, or indeed any customer-recommended changes.

Version 9.1 HF4

IMPORTANT

For customers deploying 9.1 HF4 to devices containing Self Encrypting Drives (SEDs), if you encounter any unexpected messages indicating that SecureDoc Installation is not proceeding on such a device, please contact WinMagic Support for assistance. 

Note: Starting with version 9.1 HF4, support for 32-bit operating systems is discontinued. This decision is aligned with industry trends and allows us to focus on optimizing and enhancing the performance, security, and features of our software for modern, 64-bit operating environments. Users are encouraged to transition to 64-bit operating systems to ensure compatibility with the latest developments and to benefit from the full range of capabilities provided by our software.

Which customers should upgrade to 9.1 HF4?

Version 9.1 HF4 is a release upgrade to the SecureDoc Enterprise Client and Server.

All customers are recommended can safely upgrade to 9.1 HF4

Why upgrade?  https://winmagic.com/blog/5-reasons-to-update-your-winmagic-securedoc-investment/

NOTE: Any customers wishing to use Microsoft Azure AD (as opposed an on-premises Active Directory) must upgrade to V9.0 (or higher).  Azure AD is not supported on earlier versions of SecureDoc Enterprise Server.  

Any Azure AD-joined Devices must be either initially installed using V9.0, or any existing devices that will be joined to an Azure AD must be upgraded to the V9.0 (or later) client software before being joined to the Azure Active Directory.

NOTE: SecureDoc installer now no longer supports installation on macOS Mojave. Version 9.1 ends support for macOS Mojave, and as a result the macOS Mojave target has been removed from the SecureDoc executables framework, installation, and run-time scripts.

End of Life Notice:

As of the current date, macOS Catalina has officially reached its End of Life (EOL) status. Users are strongly advised to upgrade to a newer macOS version to ensure the security and functionality of their systems. We are no longer supporting macOS Catalina.

IMPORTANT: For customers wishing to utilize SecureDoc’s Bluetooth Low Energy mobile device-based authentication at Pre-Boot:

1 - The device Profile must specify the Linux-based Pre-Boot for UEFI devices – termed as PBLU in this documentation.  Phone-based authentication (whether using Bluetooth Low Energy communication or network-based communication) does not work with

2 – Bluetooth must be enabled in the endpoint computer’s hardware configuration (BIOS or UEFI settings), as use of Bluetooth Low Energy mobile device-based authentication is a compelling security feature.,

NOTE: These release notes are presented in a new format compared to prior releases. A) Rather than leading with the ticket number(s), these will include the ticket(s) at the end of each release note; b) Issues and improvements will be grouped into meaningful groups that discuss specific aspects of the product (e.g., Authentication, Server, client, and other groupings).

How to Install/Upgrade

Customers with an active support plan should contact [email protected] to receive the latest download link for their SecureDoc upgrade.

Resolved Issues

SecureDoc For Windows

SD-47363 Customization of Connectivity Timeout: Enhancing Flexibility and Performance.

Issue: [BLE]: BLE functionality compromised during preboot when ethernet or display cables are connected. Establishing BLE connectivity requires multiple attempts when ethernet or display cables are attached.

Solution: To address the issue, we've updated the ability to allow customization of connectivity timeout, thereby enabling the adjustment of the timeout duration as per specific requirements or preferences.

SD-47366 Resolving Fingerprint Sensor Dysfunction Caused by SD Card Installation.

Issue: The fingerprint sensor stops working when the SD card is inserted.

Solution: The underlying problem was effectively addressed by taking the step to eliminate the locking mechanism within the device. By removing this restrictive element, the device can now operate more fluidly, allowing both the SD card and the fingerprint sensor to function together without issue, thereby restoring full functionality and ensuring a smoother user experience.

SD-47496 Preboot Authentication Failure on Dell Latitude 3580 with PIV Card Use.

Issue:  When attempting to authenticate Preboot using a PIV Card on a Dell Latitude 3580, the process fails, and Error PBA 139 is displayed, preventing Windows from loading.

Solution: To address the issue, we made a strategic update to a critical system file known as "E3.BIN." This modification involved deactivating the Opensc-pkcs11 library, which was initially used for managing PIV card interactions.

In its place, we switched to utilizing the WM libc library, a move aimed at enhancing compatibility and reliability with PIV cards. This change is designed to streamline the process, ensuring that the use of PIV cards no longer triggers the previous error, thereby allowing for a smoother preboot authentication experience on the Dell Latitude 3580.

SES WEB

SD-44844 Enable SES to monitor and provide reports on the percentage of encryption completion for clients.

Issue: The aim is to ensure SES WEB stays informed about the status of encryption and decryption processes, so SES administrators can check that everything is proceeding smoothly without any hitches. The idea is for the SD client to regularly update SES on the encryption progress, providing updates at significant milestones throughout the drive’s encryption journey.

This way, SES WEB would visually represent progress in clear stages, confirming ongoing operation until the entire process is successfully completed.

Solution: To enhance monitoring, a simple setting change (`UpdateProgressToServer=1`) in the profile settings allows SES WEB to track how far along the encryption process is on a client's device, but only the first time the encryption software is set up. The progress updates in noticeable stages, visible on SES WEB, ensuring administrators can easily check on the process. If the encryption gets interrupted for any reason, like a system restart, it cleverly picks up where it left off, keeping track of progress to ensure nothing gets missed.

Note: This only works for the initial setup and doesn’t cover certain encryption types or decryption processes. For these, SES WEB will simply show whether encryption or decryption is happening without showing how much has been completed.

SD-47620 Resolving the "Last Communication" Timestamp Display Issue in SESWEB.

Issue: A glitch in SESWEB version 9.1.004.1368, where "Last Communication" timestamp was missing from the platform's display and the Excel reports generated from it. This timestamp is vital for administrators to assess when devices last interacted with SESWEB, playing a key role in monitoring device connectivity and troubleshooting.

Solution: The issue has been successfully addressed and corrected in the update 9.1HF4. This fix ensures that the "Last Communication" timestamp is now properly shown in SESWEB and in the Excel reports, improving administrators' ability to keep track of device status and maintain effective oversight over their networked devices.

SD-47676 Enhanced User ID Visibility in SES System.

Issue: An issue persisted with the visibility of user IDs even after enabling the necessary permissions. This issue was consistent even in setups involving new databases. The server, which had been upgraded from version 8.6 SR1 to 9.1, was under review for these discrepancies.

Solution: The recent SES system update has successfully resolved the issue of user ID visibility on its interfaces. The improvement ensures user IDs are now properly displayed, enhancing system usability.

Contact WinMagic

Acknowledgements

This product includes cryptographic software written by Antoon Bosselaers, Hans Dobbertin, Bart Preneel, Eric Young ([email protected]) and Joan Daemen and Vincent Rijmen, creators of the Rijndael AES algorithm.

This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.OpenSSL.org/).

WinMagic would like to thank these developers for their software contributions.

©Copyright 1997 – 2024 by WinMagic Corp. All rights reserved.

Printed in Canada Many products, software and technologies are subject to export control for both Canada and the United States of America. WinMagic advises all customers that they are responsible for familiarizing themselves with these regulations. Exports and re-exports of WinMagic Inc. products are subject to Canadian and US export controls administered by the Canadian Border Services Agency (CBSA) and the Commerce Department’s Bureau of Industry and Security (BIS). For more information, visit WinMagic’s web site or the web site of the appropriate agency.

WinMagic, SecureDoc, SecureDoc Enterprise Server, Compartmental SecureDoc, SecureDoc PDA, SecureDoc Personal Edition, SecureDoc RME, SecureDoc Removable Media Encryption, SecureDoc Media Viewer, SecureDoc Express, SecureDoc for Mac, MySecureDoc, MySecureDoc Personal Edition Plus, MySecureDoc Media, PBConnex, SecureDoc Central Database, SecureDoc Cloud Lite, MagicEndpoint and MagicEndpoint FIDO Eazy are trademarks and registered trademarks of WinMagic Inc., registered in the US and other countries. All other registered and unregistered trademarks herein are the sole property of their respective owners. © 2023 WinMagic Corp. All rights reserved.

© Copyright 2024 WinMagic Corp. All rights reserved. This document is for informational purpose only. WinMagic Corp. makes NO WARRANTIES, expressed or implied, in this document. All specification stated herein are subject to change without notice.