McAfee Inc. recommends immediately updating the virus scanning engine of a dozen older versions of its products to correct a highly critical flaw that could allow a remote attacker to gain system access. This is the fifth time in recent months that serious flaws have been revealed in the widely used virus-scanner.
The Santa Clara, Calif.-based company said, "McAfee customers operating on a previous version of the McAfee VirusScan Scan Engine [version 4320] are susceptible to a buffer overrun when scanning LHA files, which could potentially lead to a compromised PC."
Internet Security Systems' X-Force
"Compromise of antivirus protected networks and machines may lead to exposure of confidential information, loss of productivity and further network compromise," ISS said in an advisory. "Implementations of McAfee AntiVirus Library are likely vulnerable through common protocols, e.g. SMTP, HTTP, FTP and SMB. It is likely McAfee AntiVirus Library implementations are vulnerable in their default configurations."
Affected products include:
- Active Mail Protection
- Active Threat Protection
- Active Virus Defense SMB Edition
- Active VirusScan SMB Edition
- GroupShield 6.x for Microsoft Exchange
- GroupShield for Exchange 2000 5.x
- GroupShield for Exchange 5.5 v4.x
- GroupShield for Exchange 5.5 v5.x
- GroupShield for Lotus Domino on AIX 5.x
- GroupShield for Lotus Domino on Windows 5.x
- GroupShield for Mail Servers with ePO
- LinuxShield 1.x
- Managed VirusScan
- Netshield for Netware 4.x
- PortalShield for Microsoft SharePoint
- SecurityShield for Microsoft ISA Server
- VirusScan 4.x
- VirusScan 8.x/2004
- VirusScan 9.x/2005
- VirusScan Command Line
- VirusScan Enterprise 8.x
- VirusScan NetApp
- VirusScan Professional 7.x
- WebShield SMTP 4.x
McAfee recommends applying the latest .dat files and updating to AV scanning engine version 4400.