http://news.com.com/McAfee+patches+holes+in+security+software/2100-1002_3-6100891.html 

By Dawn Kawamoto
Staff Writer, CNET News.com
August 1, 2006

McAfee has patched flaws in its SecurityCenter software, pervasive 
technology found in all of its consumer products from VirusScan to Total 
Protection to its Internet Security Suite.

The company has sent out a SecurityCenter 7.0 update to address the 
vulnerabilities, which could allow intruders to gain remote control of PCs 
Systems if the user clicks on a link to a malicious Web site, according to 
a security bulletin posted by McAfee on Monday.

The problems relate to SecurityCenter 4.3 through 6.0.22, the company 
said. Consumers who prefer to stay with these older versions should expect 
to receive a security patch from McAfee on Wednesday. Enterprise versions 
of the software were not affected by the flaws, McAfee noted.

SecurityCenter is designed to provide people with information on the 
security status of their system with one click of a mouse. It is geared 
toward consumers and small businesses.

"SecurityCenter is a consumer product, so the level of defense is less 
than a corporate network," said Mike Puterbaugh, a spokesman for eEye 
Digital Security, which discovered and reported the flaw to McAfee.

eEye rates the vulnerabilities as "highly critical," due to its potential 
to allow remote execution of code. McAfee, however, rates the flaws as a 
"medium" threat, because it requires user intervention to take effect.

Consumers also tend to be less likely to install updates, unless they are 
clearly labeled as a security update, Puterbaugh said.

McAfee, which was notified by eEye of the SecurityCenter flaws on July 19, 
said it has yet to receive any reports of systems being compromised.

Some customers have complained that the SecurityCenter 7.0 update caused 
Microsoft ActiveSync to fail when they tried to sync up their handheld 
computers. McAfee is reviewing the matter, a company representative said.

The SecurityCenter vulnerabilities mark the second time this month McAfee 
has been notified by eEye of flaws in its software. Earlier this month, 
eEye announced it had found a flaw in McAfee's ePolicy Orchestrator, a 
centralized security management and monitoring console used by corporate 
customers. The flaw, which required no user interaction to exploit, was 
located in the Framework Service component of the console.


_________________________________
Attend the Black Hat Briefings and
Training, Las Vegas July 29 - August 3
2,500+ international security experts from 40 nations,
10 tracks, no vendor pitches.
www.blackhat.com