Article

Highly critical McAfee flaws patched

Shawna McAlearney, News Editor

McAfee Inc. recommends immediately updating the virus scanning engine of a dozen older versions of its products to correct a highly critical flaw that could allow a remote attacker to gain system access. This is the fifth time in recent months that serious flaws have been revealed in the widely used virus-scanner.

The Santa Clara, Calif.-based company said, "McAfee customers operating on a previous version of the McAfee VirusScan Scan Engine [version 4320] are susceptible to a buffer overrun when scanning LHA files, which could potentially lead to a compromised PC."

Internet Security Systems' X-Force

    Requires Free Membership to View

More on patch management

Products of the Year: Patch management
Information Security magazine unveils the best patch management products of 2004.

Check out more articles and tips on patch management.

discovered the flaws and said that by crafting an LHA file, an attacker is able to trigger a stack overflow within the process importing the McAfee AntiVirus Library, which is critical to providing antivirus for desktop, server and gateway systems.

"Compromise of antivirus protected networks and machines may lead to exposure of confidential information, loss of productivity and further network compromise," ISS said in an advisory. "Implementations of McAfee AntiVirus Library are likely vulnerable through common protocols, e.g. SMTP, HTTP, FTP and SMB. It is likely McAfee AntiVirus Library implementations are vulnerable in their default configurations."

Affected products include:

  • Active Mail Protection
  • Active Threat Protection
  • Active Virus Defense SMB Edition
  • Active VirusScan SMB Edition
  • GroupShield 6.x for Microsoft Exchange
  • GroupShield for Exchange 2000 5.x
  • GroupShield for Exchange 5.5 v4.x
  • GroupShield for Exchange 5.5 v5.x
  • GroupShield for Lotus Domino on AIX 5.x
  • GroupShield for Lotus Domino on Windows 5.x
  • GroupShield for Mail Servers with ePO
  • LinuxShield 1.x
  • Managed VirusScan
  • Netshield for Netware 4.x
  • PortalShield for Microsoft SharePoint
  • SecurityShield for Microsoft ISA Server
  • Virex
  • VirusScan 4.x
  • VirusScan 8.x/2004
  • VirusScan 9.x/2005
  • VirusScan Command Line
  • VirusScan Enterprise 8.x
  • VirusScan NetApp
  • VirusScan Professional 7.x
  • WebShield SMTP 4.x

McAfee recommends applying the latest .dat files and updating to AV scanning engine version 4400.


There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: