Motion Sensors / Detectors / Transducers
Vulnerability Advisory: McAfee, Inc. Solutions Protect Against Four Newly Disclosed Microsoft Vulnerabilities
McAfee Intrusion Prevention and Security Risk Management Solutions Provide Protection to Identify and Block Potential New Attacks
SANTA CLARA, Calif., Sept. 11 -- McAfee, Inc. (NYSE:MFE), announced that it provides coverage for the four security vulnerabilities disclosed by Microsoft Corporation today. These vulnerabilities have been reviewed by McAfee® Avert® Labs, and based on their findings, McAfee recommends that users confirm the Microsoft product versioning outlined in the bulletins and update as recommended by Microsoft and McAfee. This includes deploying solutions to ensure protection against the vulnerabilities outlined in this advisory.
"Compared to last month, Patch Tuesday in September is almost anticlimactic," said Dave Marcus, security research and communications manager at McAfee Avert Labs. "Users of Windows Server 2000 Service Pack 4 should be paying most attention to Microsoft's patches. The MSN Messenger and Windows Live Messenger vulnerability is also serious, but since Microsoft pushes the updates there is little chance of successful attacks exploiting this vulnerability."
Microsoft Vulnerabilities Overview:
o MS07-051 - Vulnerability in Microsoft Agent could allow remote code execution
o MS07-052 - Vulnerability in Crystal Reports for Visual Studio could allow remote code execution
o MS07-053 - Vulnerability in Windows Services for Unix could allow elevation of privilege
o MS07-054 - Vulnerability in MSN Messenger and Windows Live Messenger could allow remote code execution
Scope of Potential Compromise
Today's four security bulletins cover a total of four vulnerabilities. One of the bulletins is rated critical by Microsoft due to the potential for remote code execution. The three remaining bulletins are deemed important.
For additional information on today's vulnerabilities as well as information on current threats, visit McAfee's Threat Center at www.mcafee.com/us/threat_center/default.asp. McAfee recommends you sign up to receive the McAfee Avert Labs Security Advisory, describing detailed McAfee product coverage on the set of vulnerabilities described in this document, as well as McAfee product coverage for other threats. To sign-up visit: www.mcafee.com/us/threat_center/securityadvisory/signup.aspx. More information on the vulnerabilities can also be found at http://www.microsoft.com/technet/security/current.aspx
McAfee Solutions
With McAfee's Security Risk Management approach, customers can effectively address business priorities and security realities. McAfee's award-winning solutions identify and block known and unknown attacks before they can cause damage. McAfee will continue to update its coverage as needed as new exploit vectors are discovered and as new threats emerge.
Out of the box, Host IPS protects against many buffer overflow exploits. McAfee Host IPS and McAfee Entercept® protect users against code execution that may result from common classes of exploits targeted at the buffer overflow/overrun vulnerabilities in Microsoft Agent. This "out of the box" protection is provided without the need for security content updates for either product.
The McAfee Vulnerability Shield package for McAfee Host IPS customers provides specific protection against common classes of exploits targeted at the vulnerabilities in Microsoft Agent and Windows Services for Unix. The Vulnerability Shield package is deployed through McAfee ePolicy Orchestrator® to agents, protecting systems without a reboot.
McAfee IntruShield® provides coverage for Microsoft Agent and Crystal Reports for Visual Studio vulnerabilities through signature sets released today. Additionally, IntruShield has protected against the MSN Messenger and Windows Live Messenger vulnerability since February. McAfee IntruShield sensors deployed in in-line mode can be configured with a response action to drop such packets for preventing these attacks.
The McAfee System Compliance Profiler, a component of McAfee ePolicy Orchestrator, is being updated for today's newly disclosed vulnerabilities in Microsoft Agent, Crystal Reports for Visual Studio, Windows Services for Unix and MSN Messenger and Windows Live Messenger to quickly assess compliance levels of the security patches announced today.
The McAfee Foundstone® and McAfee Network Access Control checks are being created to detect the vulnerabilities announced today, and will be available in the packages released today and the day after tomorrow, respectively. These checks are expected to accurately identify if a system is vulnerable in many enterprise environments.
McAfee Policy Auditor compliance checks and McAfee Remediation Manager remediations are being created to identify unpatched systems and apply the necessary patches to affected systems for the vulnerabilities in Microsoft Agent, Crystal Reports for Visual Studio, Windows Services for Unix and MSN Messenger and Windows Live Messenger. Updates will be available in the next V-Flash package.
Avert DAT files have already been released to detect known exploits and new detection will be added as new exploits are discovered. DAT files are used by McAfee GroupShield®, PortalShield(TM), Secure Internet Gateway appliances, Secure Messaging Gateway appliances, Secure Web Gateway appliances, Total Protection suites, VirusScan Enterprise, VirusScan Command Line, VirusScan Online and other McAfee scanners. McAfee users can refer to www.mcafee.com/us/threat_center/default.asp for information regarding any new threats attempting to exploit these vulnerabilities.
McAfee Avert Labs maintains one of the top-ranked security threat and research organizations in the world, employing researchers in 16 countries around the globe. The Labs combine world-class malicious code and anti-virus research with intrusion prevention and vulnerability research expertise. McAfee protects customers by providing deep analysis and core technologies that are developed through the combined efforts of its researchers. McAfee Avert Labs continually monitors the Internet for new threats and attack vectors on a daily basis. Whenever possible, we will update our security technologies and coverage as these new threats and vectors emerge.
About McAfee, Inc.:
McAfee Inc., the leading dedicated security technology company, headquartered in Santa Clara, California, delivers proactive and proven solutions and services that secure systems and networks around the world. With its unmatched security expertise and commitment to innovation, McAfee empowers home users, businesses, the public sector, and service providers with the ability to block attacks, prevent disruptions, and continuously track and improve their security. http://www.mcafee.com/.
Source: McAfee, Inc.
CONTACT: Joris Evers of McAfee, Inc., +1-408-346-3310,
joris_evers@mcafee.com; or Diana Williams of Red Consultancy, +1-415-618-8812, diana.williams@redconsultancy.com, for McAfee, Inc.
Web site: http://www.mcafee.com/
