eEye Warns of Worm Hole in McAfee Anti-virus Products

A code execution vulnerability in software products sold by Internet security vendor McAfee could put millions at risk of computer takeover attacks, according to a warning from eEye Digital Security.

The flaw affects fully patched versions of all McAfee consumer security products, including the companys flagship McAfee Internet Security Suite 2006.

eEye Chief Hacking Officer Marc Maiffret, in Aliso Viejo, Calif., said his company is withholding technical details on the vulnerability until McAfee completes work on a patch.

/zimages/3/28571.gifFor advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internets Security IT Hub.

Maiffret said the issue was discovered and reported to McAfee on July 19.

“This vulnerability can be used to compromise systems running these McAfee consumer products and allow attackers to run code with the ability to modify/delete files [or] backdoor systems,” Maiffret said in an e-mail exchange with eWEEK.

In keeping with its disclosure policy, eEye has posted a deliberately vague advisory on the bug.

Maiffret said his companys researchers were able to successfully compromise the following products: McAfee Internet Security Suite 2006, McAfee Wireless Home Network Security, McAfee Personal Firewall Plus, McAfee VirusScan, McAfee Privacy Service, McAfee SpamKiller and McAfee AntiSpyware.

/zimages/3/28571.gifCheck out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.