Highly critical McAfee flaws patched

Article

Highly critical McAfee flaws patched

Shawna McAlearney, News Editor

McAfee Inc. recommends immediately updating the virus scanning engine of a dozen older versions of its products to correct a highly critical flaw that could allow a remote attacker to gain system access. This is the fifth time in recent months that serious flaws have been revealed in the widely used virus-scanner.

The Santa Clara, Calif.-based company said, "McAfee customers operating on a previous version of the McAfee VirusScan Scan Engine [version 4320] are susceptible to a buffer overrun when scanning LHA files, which could potentially lead to a compromised PC."

Internet Security Systems' X-Force

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

More on patch management

Products of the Year: Patch management
Information Security magazine unveils the best patch management products of 2004.

Check out more articles and tips on patch management.

discovered the flaws and said that by crafting an LHA file, an attacker is able to trigger a stack overflow within the process importing the McAfee AntiVirus Library, which is critical to providing antivirus for desktop, server and gateway systems.

"Compromise of antivirus protected networks and machines may lead to exposure of confidential information, loss of productivity and further network compromise," ISS said in an advisory. "Implementations of McAfee AntiVirus Library are likely vulnerable through common protocols, e.g. SMTP, HTTP, FTP and SMB. It is likely McAfee AntiVirus Library implementations are vulnerable in their default configurations."

Affected products include:

  • Active Mail Protection
  • Active Threat Protection
  • Active Virus Defense SMB Edition
  • Active VirusScan SMB Edition
  • GroupShield 6.x for Microsoft Exchange
  • GroupShield for Exchange 2000 5.x
  • GroupShield for Exchange 5.5 v4.x
  • GroupShield for Exchange 5.5 v5.x
  • GroupShield for Lotus Domino on AIX 5.x
  • GroupShield for Lotus Domino on Windows 5.x
  • GroupShield for Mail Servers with ePO
  • LinuxShield 1.x
  • Managed VirusScan
  • Netshield for Netware 4.x
  • PortalShield for Microsoft SharePoint
  • SecurityShield for Microsoft ISA Server
  • Virex
  • VirusScan 4.x
  • VirusScan 8.x/2004
  • VirusScan 9.x/2005
  • VirusScan Command Line
  • VirusScan Enterprise 8.x
  • VirusScan NetApp
  • VirusScan Professional 7.x
  • WebShield SMTP 4.x

McAfee recommends applying the latest .dat files and updating to AV scanning engine version 4400.