Release Notes Tanium Server (Version 7.3.314.4147)

Thank you for choosing Tanium.  The following Release Notes document changes between releases of the Tanium Server.
This platform release includes the release of both a Windows and Linux Tanium Server.
The previous version can be found here: Release Notes (Version 7.3.314.4103)

Tanium Server for Windows and Linux v7.3.314.4147

General Availability Release Date: Aug 13, 2019.

Special Notes

• Due to security issues against this release of Tanium Server, Tanium strongly recommends upgrading to at least v7.3.314.4324 if you are using this version.

New Features

• N/A.

Improvements

• The Tanium Server now uses CUIC v1.3.3.0142 .

Security Updates

• This release includes security updates. Details of the issues, including affected versions and mitigation information, can be obtained within Tanium's Support Portal or by contacting your TAM.

Bug Fixes

• Fixed an issue in the propagation of XML namespaces when canonicalizing SAML requests.
• Fixed a sporadic logging problem which could cause TDownloader to crash and create a core file when trying to log certain messages while shutting down.
• Improved the mechanisms by which the Tanium Server executes the TaniumTDownloader process which, in extremely large deployments would eventually cause instability of the TaniumServer process operation and communications.
• Fixed an issue where deleting a Computer Group from an RBAC User Group could result in stale data being reported until the Tanium Server's user cache was refreshed by another modification operation.
• Fixed a problem with the Tanium Server REST Import API which, for certain type of Sensors would return: HTTP 400: InvalidSensorScriptType.
• Fixed an issue in the the Tanium Server REST Import API which could lead to duplicate Saved Question names and generate the log error messages: STATEMENT: insert into dashboards_saved_questions ... related by a subquery ERROR: more than one row returned by a subquery: select id from dashboards where name = ....
• Fixed a small issue in logging where a message might not end in a newline (\n) character while simultaneously handling an exception.
• Fixed a race condition within the Tanium Server while creating a Regular Expression object to be consumed by multiple threads. This contention could lead to a malformed object that produced a crash of the server process.
• Fixed a potential data-race condition in the Tanium Question Parser where modifications and reads might circumvent a controlling mutex.
• On a new, fresh install of the Tanium Server, the SOAPUseSessionFlag Global Setting will be created with a default value of 1 (one), thus by default hardening access to the Tanium Client's local (127.0.0.1) download API.
• Modified the behavior of the /auth authentication route to allow for the login of user accounts of the form domain.com\[email protected], a format which has caused problems for LDAP-synchronized accounts that made use of the userPrincipalName property in LDAP.
• Fixed an issue with the Tanium Server API where trying to add a Computer Group with a canonical filter with more than one sensor would fail with the error message: InvalidGroupQueryText: Invalid group text: Unexpected parse result - expected sub_groups with one group.
• Improved on minor risks for multi-thread use-after-free risks when accessing Global Settings in the Tanium Server.
• The default value for the ClientConnectionThreads setting on a Tanium Server will now be the smaller value between 16 and the number of available CPU cores. Latest testing indicate this will deliver the highest possible performance in handling incoming Tanium Client connections.
• Introduced additional mutex protections for periodic job execution settings that are accessed by multiple threads.
• Code improvements to eliminate the risk of use-after-free in client connection counters.
• The Tanium Server Question Parser has been updated to use ANTLR v4.7.2.
• Fixed an issue with the Tanium Server's sqlserver2postgres feature where source columns of type VarBinary would not be handled correctly and fail the SQL export, and where target PostgreSQL sequence numbers failed to be set to correct values.
• Modified the behavior of the Tanium Server subsystem which removes old Scheduled Actions and Action records from the database, to ensure that the latter (Actions) are not orphaned by the removal of the Scheduled Action that created them.
• Fixed a problem in the set-up of sequence columns, as produced by the Tanium Server option to assist migration: TaniumReceiver.exe database sqlserver2postgres .
• Fixed a problem where an API call to UpdateObject on a user object would reset its group ID (and effective group ID) to zero, which was incorrect.

Known Issues and Workarounds

• The Tanium Module Server will fail to register with the Tanium Server if installed on TanOS versions prior to v1.5.1.
  Workaround: There is no workaround for this condition.

Additional Information

• This version of Tanium Server shipped with Common UI Components version 1.3.3.0142.

Product Documentation and Resources

• Tanium Product Documentation
• Tanium User Research
• Software Updates and Announcements Signup