Slashdot Mirror
McAfee Takes Six Months To Patch Remote Code Exploit In Linux VirusScan Enterprise (theregister.co.uk)
mask.of.sanity writes: A researcher has reported 10 vulnerabilities in McAfee's VirusScan Enterprise for Linux that when chained together result in root remote code execution. McAfee took six months to fix the bugs issuing a patch December 9th.
Citing the security note, CSO adds that "one of the issues affects Virus Scan Enterprise for Windows version 8.7i through at least 8.8." The vulnerability was reported by Andrew Fasano at MIT's federally-funded security lab, who said he targeted McAfee's client because "it runs as root, it claims to make your machine more secure, it's not particularly popular, and it looks like it hasn't been updated in a long time."
Citing the security note, CSO adds that "one of the issues affects Virus Scan Enterprise for Windows version 8.7i through at least 8.8." The vulnerability was reported by Andrew Fasano at MIT's federally-funded security lab, who said he targeted McAfee's client because "it runs as root, it claims to make your machine more secure, it's not particularly popular, and it looks like it hasn't been updated in a long time."
And I fired him that day.
That dude's bad news. Somebody should burn his house down.
How common is it for Linux systems to have discrete anti-virus software running on them?
AmigaOS or GTFO.
http://cvedetails.com
You are completely wrong, but I'm sure that this isn't the first time.
MS-DOS 2.0/2.1 is quite secure from what I hear. Hey 2.1 even supports something they are calling subdirectories.
...aaaaaand you've just been trolled
MS-DOS 2.0/2.1 is quite secure from what I hear. Hey 2.1 even supports something they are calling subdirectories.
I just ordered a new one for my mother with a bigger screen, which may be easier to read, but that won't be there for several days. It was a 15.6" 1080P for $339. asus laptop The main things there is it is 5.1 pounds, 15.6" and 1080P.
I just heard her current one is asking to call an 800 number... Does anyone have any tips for securing windows 10 beyond the usual updates and such? I'll reimage the older laptop to linux, which should at least help, but 10 is likely better for the high DPI display on the newer one.
Also if anyone is thinking of buying a 32GB eMMC based win 10 laptop, well don't, at least if you plan to keep 10. You rapidly run out of space and the updates fail. You can get around it with some work, but it is a pain. I considered a chromebook, but that limits what is possible to run on it a fair amount. The new laptop has a cheap 500GB hard disk, which would allow me to dual boot linux mint, though I'm not sure if that complexity is worth it. Still, it might provide a backup OS should the primary be compromised.
Exactly as he said. You put profesionally managed Linux or FreeBSD boxes directly connected to the internet, between the net and your users on Windows desktops. Especially 5-20 years ago, when Windows was SO vulnerable, it made (and makes) good sense to put some protection between the users and the internet.
To protect *nix boxes, especially servers, some people use an intrusion detection system / intrusion prevention system (IDS/IPS). You can set it to alert you if any files change on the server, other than the types of changes you expect in the data files. Mod_security can block and report any suspicious web requests, etc. Because the servers typically have one job to do, or just a few tasks, you can configure it to block everything other than the expected traffic and behavior. Therefore you don't need to detect malware or other bad stuff, you just define the few things that *are* allowed and deny anything else.
You can tell a company IT department is run by clueless morons if they install McAfee products, which have always caused many more problems then they've prevented.
Many years ago, McAfee was a good AV product but it has been junk for several years now. Unfortunately, it is getting tough to find a reliable AV that is suitable for computer literate customers. This story is not the only example of McAfee actually reducing the security of the machines it is installed on.
In the past, I encouraged people in a business environment to used the AV product that they preferred. That diversity can help to catch threats that a single product misses. Those with McAfee installed were the laptops that were most often infected by a virus and often the evidence of infection came from other computers with different AV products that prevented an infection. It was scary just how bad it was so I had to change the policy to ban it.
Unfortunately, it is tough to find a good AV product, that is reliable and does not cause more problems than an extensive infection. Too many false positives, huge drops in performance, interruption work of productive work with forced reboots and annoying popups are widespread. I used AVG for many years, including in a volume licensed business environment, until it became crapware as well... Now I rely on other security products and systems that a virus resistant.
It takes me 6 months to stop laughing when someone suggests their products are a good solution to any given problem.
Most responses I get to anti virus or security on a Linux desktop is that you don't need it. Much like what Mac OS users tell their flock. Because of the lack of total user base, I think support for Linux from these companies is a token attempt at satisfying the few. Obviously they do not do that very well.
They were probably pretty shocked to learn that anyone was using this product. Or perhaps that they even made it at all.
See subject: Hosts block infection blocking ability to communicate w/ sources of infestation in 1st place (more proactive vs. antivirus letting you be infested & removing it IF it can. It's better than "heuristics" inaccuracies antivirus uses too - false positives galore it's prone to).
Hosts = NATIVE part of IP stack you already have using FAR less resources + moving parts for exploit (antivirus is prone to as this article shows along w/ TAVIS ORMANDY finding security holes in antiviruses galore)
* Hosts = IMMEDIATELY EDITABLE by users (e.g. notepad.exe) for "self-patching" adding OR removing entries manually.
APK
P.S.=> For automated production & maintenance of hosts (4 more speed, security, reliability & anonymity online)? APK Hosts File Engine 9.0++ SR-4 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ ... apk