News Stay informed about the latest enterprise technology news and product updates.

Highly critical McAfee flaws patched

A dozen McAfee products have holes that could allow remote system access.

McAfee Inc. recommends immediately updating the virus scanning engine of a dozen older versions of its products to correct a highly critical flaw that could allow a remote attacker to gain system access. This is the fifth time in recent months that serious flaws have been revealed in the widely used virus-scanner.

The Santa Clara, Calif.-based company said, "McAfee customers operating on a previous version of the McAfee VirusScan Scan Engine [version 4320] are susceptible to a buffer overrun when scanning LHA files, which could potentially lead to a compromised PC."

Internet Security Systems' X-Force

More on patch management

Products of the Year: Patch management
Information Security magazine unveils the best patch management products of 2004.

Check out more articles and tips on patch management.

discovered the flaws and said that by crafting an LHA file, an attacker is able to trigger a stack overflow within the process importing the McAfee AntiVirus Library, which is critical to providing antivirus for desktop, server and gateway systems.

"Compromise of antivirus protected networks and machines may lead to exposure of confidential information, loss of productivity and further network compromise," ISS said in an advisory. "Implementations of McAfee AntiVirus Library are likely vulnerable through common protocols, e.g. SMTP, HTTP, FTP and SMB. It is likely McAfee AntiVirus Library implementations are vulnerable in their default configurations."

Affected products include:

  • Active Mail Protection
  • Active Threat Protection
  • Active Virus Defense SMB Edition
  • Active VirusScan SMB Edition
  • GroupShield 6.x for Microsoft Exchange
  • GroupShield for Exchange 2000 5.x
  • GroupShield for Exchange 5.5 v4.x
  • GroupShield for Exchange 5.5 v5.x
  • GroupShield for Lotus Domino on AIX 5.x
  • GroupShield for Lotus Domino on Windows 5.x
  • GroupShield for Mail Servers with ePO
  • LinuxShield 1.x
  • Managed VirusScan
  • Netshield for Netware 4.x
  • PortalShield for Microsoft SharePoint
  • SecurityShield for Microsoft ISA Server
  • Virex
  • VirusScan 4.x
  • VirusScan 8.x/2004
  • VirusScan 9.x/2005
  • VirusScan Command Line
  • VirusScan Enterprise 8.x
  • VirusScan NetApp
  • VirusScan Professional 7.x
  • WebShield SMTP 4.x

McAfee recommends applying the latest .dat files and updating to AV scanning engine version 4400.

Dig Deeper on Emerging cyberattacks and threats

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.