Slashdot Mirror
McAfee Takes Six Months To Patch Remote Code Exploit In Linux VirusScan Enterprise (theregister.co.uk)
mask.of.sanity writes: A researcher has reported 10 vulnerabilities in McAfee's VirusScan Enterprise for Linux that when chained together result in root remote code execution. McAfee took six months to fix the bugs issuing a patch December 9th.
Citing the security note, CSO adds that "one of the issues affects Virus Scan Enterprise for Windows version 8.7i through at least 8.8." The vulnerability was reported by Andrew Fasano at MIT's federally-funded security lab, who said he targeted McAfee's client because "it runs as root, it claims to make your machine more secure, it's not particularly popular, and it looks like it hasn't been updated in a long time."
Citing the security note, CSO adds that "one of the issues affects Virus Scan Enterprise for Windows version 8.7i through at least 8.8." The vulnerability was reported by Andrew Fasano at MIT's federally-funded security lab, who said he targeted McAfee's client because "it runs as root, it claims to make your machine more secure, it's not particularly popular, and it looks like it hasn't been updated in a long time."
And I fired him that day.
That dude's bad news. Somebody should burn his house down.
How common is it for Linux systems to have discrete anti-virus software running on them?
A real swiss cheese! Probably Linux was one vector for all the recent data breaches we have been hearing about. I really wouldn't recommend anyone use Linux on the cloud... Windows has been doing pretty well, though.
Exactly as he said. You put profesionally managed Linux or FreeBSD boxes directly connected to the internet, between the net and your users on Windows desktops. Especially 5-20 years ago, when Windows was SO vulnerable, it made (and makes) good sense to put some protection between the users and the internet.
To protect *nix boxes, especially servers, some people use an intrusion detection system / intrusion prevention system (IDS/IPS). You can set it to alert you if any files change on the server, other than the types of changes you expect in the data files. Mod_security can block and report any suspicious web requests, etc. Because the servers typically have one job to do, or just a few tasks, you can configure it to block everything other than the expected traffic and behavior. Therefore you don't need to detect malware or other bad stuff, you just define the few things that *are* allowed and deny anything else.
You can tell a company IT department is run by clueless morons if they install McAfee products, which have always caused many more problems then they've prevented.
Many years ago, McAfee was a good AV product but it has been junk for several years now. Unfortunately, it is getting tough to find a reliable AV that is suitable for computer literate customers. This story is not the only example of McAfee actually reducing the security of the machines it is installed on.
In the past, I encouraged people in a business environment to used the AV product that they preferred. That diversity can help to catch threats that a single product misses. Those with McAfee installed were the laptops that were most often infected by a virus and often the evidence of infection came from other computers with different AV products that prevented an infection. It was scary just how bad it was so I had to change the policy to ban it.
Unfortunately, it is tough to find a good AV product, that is reliable and does not cause more problems than an extensive infection. Too many false positives, huge drops in performance, interruption work of productive work with forced reboots and annoying popups are widespread. I used AVG for many years, including in a volume licensed business environment, until it became crapware as well... Now I rely on other security products and systems that a virus resistant.
It takes me 6 months to stop laughing when someone suggests their products are a good solution to any given problem.
Most responses I get to anti virus or security on a Linux desktop is that you don't need it. Much like what Mac OS users tell their flock. Because of the lack of total user base, I think support for Linux from these companies is a token attempt at satisfying the few. Obviously they do not do that very well.
They were probably pretty shocked to learn that anyone was using this product. Or perhaps that they even made it at all.
See subject: Hosts block infection blocking ability to communicate w/ sources of infestation in 1st place (more proactive vs. antivirus letting you be infested & removing it IF it can. It's better than "heuristics" inaccuracies antivirus uses too - false positives galore it's prone to).
Hosts = NATIVE part of IP stack you already have using FAR less resources + moving parts for exploit (antivirus is prone to as this article shows along w/ TAVIS ORMANDY finding security holes in antiviruses galore)
* Hosts = IMMEDIATELY EDITABLE by users (e.g. notepad.exe) for "self-patching" adding OR removing entries manually.
APK
P.S.=> For automated production & maintenance of hosts (4 more speed, security, reliability & anonymity online)? APK Hosts File Engine 9.0++ SR-4 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ ... apk