By Dawn Kawamoto
Staff Writer, CNET News.com
August 1, 2006
McAfee has patched flaws in its SecurityCenter software, pervasive
technology found in all of its consumer products from VirusScan to Total
Protection to its Internet Security Suite.
The company has sent out a SecurityCenter 7.0 update to address the
vulnerabilities, which could allow intruders to gain remote control of PCs
Systems if the user clicks on a link to a malicious Web site, according to
a security bulletin posted by McAfee on Monday.
The problems relate to SecurityCenter 4.3 through 6.0.22, the company
said. Consumers who prefer to stay with these older versions should expect
to receive a security patch from McAfee on Wednesday. Enterprise versions
of the software were not affected by the flaws, McAfee noted.
SecurityCenter is designed to provide people with information on the
security status of their system with one click of a mouse. It is geared
toward consumers and small businesses.
"SecurityCenter is a consumer product, so the level of defense is less
than a corporate network," said Mike Puterbaugh, a spokesman for eEye
Digital Security, which discovered and reported the flaw to McAfee.
eEye rates the vulnerabilities as "highly critical," due to its potential
to allow remote execution of code. McAfee, however, rates the flaws as a
"medium" threat, because it requires user intervention to take effect.
Consumers also tend to be less likely to install updates, unless they are
clearly labeled as a security update, Puterbaugh said.
McAfee, which was notified by eEye of the SecurityCenter flaws on July 19,
said it has yet to receive any reports of systems being compromised.
Some customers have complained that the SecurityCenter 7.0 update caused
Microsoft ActiveSync to fail when they tried to sync up their handheld
computers. McAfee is reviewing the matter, a company representative said.
The SecurityCenter vulnerabilities mark the second time this month McAfee
has been notified by eEye of flaws in its software. Earlier this month,
eEye announced it had found a flaw in McAfee's ePolicy Orchestrator, a
centralized security management and monitoring console used by corporate
customers. The flaw, which required no user interaction to exploit, was
located in the Framework Service component of the console.
Attend the Black Hat Briefings and
Training, Las Vegas July 29 - August 3
2,500+ international security experts from 40 nations,
10 tracks, no vendor pitches.