08-19-2022 07:32 AM
Bit of a weird one but has anyone experienced issues with office add ins that uses the clipboard functionality?
seem to be having intermittent errors with it and it just straight up not working.
Tried removing the cortex agent from one or two systems and it seemed to have restored clipboard functionality to the add in, one still did continue with errors after it was removed though.
I cant see any logs in cortex that would suggest it was blocking this so I am not 100% sure cortex is causing the issue but i just thought i would ask here and see if anyone had anything similar.
Agent version is 7.7.8
08-20-2022 02:51 AM - edited 08-20-2022 07:16 AM
I see that you have mentioned agent version as 7.7.8.
It seems there is a typo, i believe you are referring to agent version 7.8 as there is no 7.7.8 version.
May I check what is the build version of XDR agent 7.8 you are using on problematic endpoints.
In this new version of XDR agent 7.8 there were some known issues identified with regards to clipboard functionality.
This issue has been fixed in latest build version of XDR agent 18.104.22.168264
If your agent lower than the version 22.214.171.124264, to resolve this issue, can you please upgrade or reinstall with this version.
Create a new agent installation package with version 126.96.36.199264 or above.
Then use this package to install or upgrade the agent on problematic endpoint.
Then monitor the endpoint to see if you are still facing the issue.
As per below article, you can find more information on the clipboard issue with 7.8 XDR agent version.
Please let me know the results of above actions.
Mark this as solution as an answer if it helped to solve the problem you are facing.
08-20-2022 05:28 AM
We are seeing similar clipboard issues in Excel only after endpoints upgrade to 188.8.131.52264. We are getting errors that the clipboard is full and there's a problem with the clipboard.
08-20-2022 07:15 AM
Ideally this issue should not be occurred with XDR agent version 184.108.40.206264 or above as per article shared.
The issue with clipboard functionality already addressed in this specific version.
However if you are still facing this issue with 220.127.116.11264, I would request you to log a support case to investigate this issue further.
Aside to above, you can also try downgrade to version 7.7.2 by uninstalling agent with 18.104.22.168264 and installing 7.7.2 version agent on the machine.
I hope that answers your query.
08-20-2022 02:21 PM
Yes I have opened a support case. The clipboard error goes away when uninstalling the Cortex Agent. We are only seeing the issue on Windows 10 clients after the upgrade to 22.214.171.124264 so I suspect the fix CPATR-17723 that was for Windows 7 and Windows 2008 R2 has introduced the issue to a new clipboard issue to Windows 10 endpoints.
08-21-2022 01:05 AM
Thanks @jruck for update.
TAC team will help you further to resolve the issue.
I hope my suggestion above helped to address your concern.
Please mark it as solution if you found it helpful.
08-21-2022 06:32 AM
Hi @creddy ,
For a quick test, what we can ask you is to add clipboard.exe to global/profile process exception(as per your choice) and select all modules under Module names. See how to do it below:
Once you have done that, you can try to enable modules one by one and checking which module makes an issue for you. Collect the support files and send it to the TAC for the fix.
Generally this can probably happen with exploits module. Ensure you have no other security solution running beside Cortex XDR which has similar exploit abilities like Cortex.
08-22-2022 06:53 AM
Sorry yes that was a typo i am using version 126.96.36.199264, i tried to make exception for clipboard.exe with all modules selected but to no avail and re-installing the agent didn't help either.
Only thing that worked was either removing the agent or dropping it down to 7.7.2.
I have opened a support case and currently awaiting to hear back.
08-22-2022 07:00 AM
Thank you so much for your response and efforts. I am sure your issue would be in good hands with Palo Alto Networks support. Please let us know the final findings and we shall be happy to suggest workarounds for future used cases like these.
08-22-2022 07:14 AM
Support gave us a Support Exception to apply to the endpoints that has resolved the issue clipboard for now until a fix is available.
08-22-2022 08:54 AM
Hi @jruck are you able to tell me the exception or is a support exception something palo alto send on to you?
08-24-2022 02:56 AM
We have the problem here, I opened a Case for it.
08-24-2022 04:14 AM
Hi @ Rindsland support were able to send me on an exception that resolved the issue until its fixed.
The service in question that was causing the issue for us was the "XQL Enhancement to Support EDR user-related operations".
Dont know if this helps but might be worth mentioning to whoever is handling your case so they can send you on the support exception for it.
08-24-2022 04:25 AM
Yes, I did that and received the Support Exception now.
Now we can copy/paste in Excel 2-3 times and then after this we still get the Error
"We couldn't free up space on the Clipboard"
So for us it's not fully resolved with the Exception.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!