Release Notes Tanium Server (Version 7.4.2.2063)

Thank you for choosing Tanium. The following Release Notes document changes between releases of the Tanium Server.
This platform release includes the release of both a Windows and Linux Tanium Server and Tanium Client binaries for all supported platforms.
The previous version can be found here: Release Notes (Version 7.4.2.2036)

Tanium Server for Windows and Linux v7.4.2.2063

General Availability Release Date: May 12, 2020.

Special Notes

• Due to security issues against this release of Tanium Server, Tanium strongly recommends upgrading to at least v7.4.5.1240 if you are using this version.
• If deploying on a Tanium Appliance, you must upgrade to TanOS v1.5.5 or greater before installing Tanium Server v7.4.
• The Tanium Server now uses Console (Version 1.4.2.0053).

Security Updates

• This release includes security updates. Details of the issues, including affected versions and mitigation information, can be obtained within Tanium's Support Portal or by contacting your TAM.

New Features

• The Tanium Client now supports the Debian v10 platform.
• The Tanium Client now offers support for the Ubuntu v20.04 platform.
• The Tanium Client now supports Oracle Linux v8 (OL v8 formerly known as OEL).
• A Tanium Client configured to communicate to a server through an HTTP proxy will now fall-back to attempt a direct connection if and after all of its configured proxies have failed to provide a successful connection.  This allows an endpoint to move in and out of proxy-controlled environments and still find the right way to to communicate up to a server.

Improvements

• Tanium components now use OpenSSL 1.0.2v.
• Changed the LogVerbosityLevel at which unknown protocol messages are logged from 10 to 40 , to avoid spamming the Tanium Client logs with the message: No handler for message.
• The Tanium Zone Server now offers the possibility to control its own bandwidth throttles instead of using the same settings as the Tanium Server. This feature can only be controlled by placing specially named and constructed JSON in the Zone Server installation directory.
• The Tanium Server /info and /metrics pages now provide per-Sensor string retry counts, making it easy to spot the source of StringRetry messages and traffic.
• The Tanium Server's LDAP connectors can now authenticate users when the "Sync group members individually" option is selected.

Bug Fixes

• Improved handling and parsing of Certificate Revocation Lists (CRLs) in the Tanium Downloader, reducing its CPU consumption when working through long revocation lists during file downloads.
• Fixed a condition on Linux Tanium Servers by which TDownloader processes could become zombies.
• Added HTTP no-cache headers to the index.html page served by the Tanium Server.
• Fixed a condition in the Tanium Server and its installer by which the server would not start when its fully qualified name (FQDN) was longer than 64 characters, logging the error: ASN1_mbstring_ncopy:string too long.
• Fixed a problem in the Tanium Client with its client extension (CX) communications which could cause it to crash.
• Fixed a problem with the cleanup of Tanium archive tables where this process would stop working, as seen by never updating the read-only Global Setting last_archive_database_cleanup_date. The scheduling of this process can now be controlled as it was before, using the archive_database_cleanup_interval to specify how often the process should run (default: 24 hours) and archive_database_cleanup_hour to specify the UTC time of day when it should run (default: 5 am UTC).
• Fixed issues with the Tanium Server's export and import of groups by which Action Groups were being exported when they should not, and already existing Computer Groups would be deleted and recreated on import, changing their referenced id numbers and creating issues in Action targeting as well as RBAC.
• Fixed an issue with the Tanium Module Server where it would constantly write diagnostics files into its TMS/info/ directory, not honoring its local info_export_interval_minutes setting (default: 60).
• Fixed an issue with the Tanium Client installer on MacOS where an installation or upgrade would only search for the legacy tanium.pub key and not the tanium-init.dat initialization bundle.
• Fixed an issue in the Tanium Server when querying for certain implied RBAC privileges which would result in a SQL exception and the error in the Tanium logs: updateModuleImpliedPrivilegesThread ... Subquery returned more than 1 value.
• Changed the frequency with which the Tanium Downloader updates download progress files on disk to 1 second , as to reduce CPU and disk resource consumption. Along with this change a command-line option --progress-file-update-milliseconds allows specifying a different update interval when necessary.
• Fixed an issue where the Tanium Module Server interpreted its info_export_max_age_days local setting as minutes instead of days, thus keeping a diagnostic files for a shorter span of time than configured.
• Fixed a caching issue in the Tanium Server where when importing a Sensor and overwriting an existing one, the column definitions on the result would be incorrect.
• Fixed an issue in the Tanium Client in the way it interprets server names in ServerNameList when they include a port number. This form would produce problems in the fallback behavior of proxy-configured clients.

Known Issues and Workarounds

• There are conditions under which the Tanium Zone Server can fall into a tight logging loop which logs: Failed to get queued I/O completions.
  Workaround: N/A.
• The Tanium Server  /info   page may display a Zone Server Hub count of zero.
  Workaround: N/A.
• Large manual Computer Groups fail to be recognized by the Tanium Server upon creation.
  Workaround: There is no workaround for this behavior. Avoid current Tanium Server v7.4 if your make use of very large manual Computer Groups until a fix is released. If you must create such large groups please plan accordingly, since you may very well require a Tanium Server restart after having created them. NOTE that this behavior does not affect existing Computer Groups or Question and Action targeting, only the Console display of such groups.

Product Documentation and Resources

• Tanium Product Documentation
• Tanium User Research
• Software Updates and Announcements Signup