Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

McAfee SaaS Antivirus Spews Spam

Spammers are actively exploiting a hole in the antivirus software to create spam relays; McAfee says patch is forthcoming.

Spammers have been exploiting a bug in McAfee's software-as-a-service (SaaS) antivirus software to turn PCs into spam relays. As a result, a number of McAfee's customers have had their emails blocked after their Internet protocol (IP) addresses were blacklisted by anti-spam services.

David Marcus, director of security research for McAfee Labs, posted a blog Wednesday detailing the two bugs being exploited to relay spam. Both bugs are in one of its products: McAfee SaaS Endpoint Protection Suite, formerly known as SaaS for Total Protection, which is a hosted anti-malware service.

McAfee, which is owned by Intel, has been actively developing and testing a patch for both bugs, which it plans to make live by Thursday. "Because this is a managed product, all affected customers will automatically receive the patch when it is released," said Marcus.

[ Security threats are running high. See Facebook Users Hit By Money-Grubbing Malware. ]

Until the patch is ready, there are "mitigating factors already in place that reduce risk" for customers, according to Marcus. In addition, he said there was "no evidence of loss or compromise of any customer data in relation to either of these issues." But network managers who want to be extra safe can proactively disable the Rumor or McAfee Peer Distribution Service, and set external firewalls to block incoming requests to port 6515. (The Kaamar.com website contains detailed instructions for doing this.)

One of the SaaS Endpoint Protection Suite bugs involves an ActiveX control, which an attacker could misuse to execute arbitrary code. Marcus said that a patch it put in place in August 2011, to address a similar issue, had prevented attackers from exploiting the new vulnerability to access customer data.

The second bug involves McAfee's "Rumor technology", which uses peer-to-peer networking to distribute security updates inside a network. Due to the bug, attackers can use machines that run the SaaS Endpoint Protection Suite as open relays for sending large amounts of spam.

"Although this issue can allow the relaying of spam, it does not give access to the data on an affected machine," said Marcus. He said McAfee's forthcoming patch will block the spam-relaying capability.

Two McAfee SaaS Endpoint Protection Suite customers, Keith and Annabel Morgan, posted a blog Monday saying that they'd had emails blacklisted by spam services, since the IP addresses on which they host their own servers were the same ones exploited by spammers via the spam-relay hole in the McAfee product. "We found our IP addresses ... on several public blacklists that had detected the spamming activity passing through our open proxy during the few days it was open."

The couple said they first detected the problem on January 4, when an email was returned, undelivered, with a notice that all email from their IP was being blocked to protect people from spam. By the next day, they said, they'd disabled the Rumor technology and halted the spam relaying. "But [we] received a traffic data limit warning from our ISP that we were approaching our whole month's traffic in only a few days," they said. "At peak we had the equivalent of 10 months of our normal traffic in one day."

IT's spending as much as ever on disaster recovery, despite advances in virtualization and cloud techniques. It's time to break free. Download our Disaster Recovery Disaster supplement now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
1/22/2012 | 6:24:46 PM
re: McAfee SaaS Antivirus Spews Spam
The update for both these issues was released Thursday, and the issue should now be patched.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Sandman366
50%
50%
Sandman366,
User Rank: Apprentice
1/20/2012 | 5:09:32 PM
re: McAfee SaaS Antivirus Spews Spam
Antivirus makes user's problems grow! (Via exploit)
Lol.
clarise12
50%
50%
clarise12,
User Rank: Apprentice
1/20/2012 | 6:08:39 AM
re: McAfee SaaS Antivirus Spews Spam
Spammers are actively exploiting a hole in the antivirus software to create spam relays.IT's spending as much as ever on disaster recovery, despite advances in virtualization and cloud techniques.
joes12
50%
50%
joes12,
User Rank: Apprentice
1/20/2012 | 5:27:51 AM
re: McAfee SaaS Antivirus Spews Spam
And also customers should be aware that McAfee released a patch last August that effectively made the vulnerability inaccessible.

Source: The Inquirer (http://s.tt/15izH)
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
State of SMB Insecurity by the Numbers
Ericka Chickowski, Contributing Writer,  10/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16966
PUBLISHED: 2019-10-21
An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\admin\modules\contactmanager\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on...
CVE-2019-9491
PUBLISHED: 2019-10-21
Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed.
CVE-2019-16964
PUBLISHED: 2019-10-21
app/call_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated attackers (with at least the permission call_center_queue_add or call_center_queue_edit) to execute any comma...
CVE-2019-16965
PUBLISHED: 2019-10-21
resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute any commands on the host as www-data.
CVE-2019-18203
PUBLISHED: 2019-10-21
On the RICOH MP 501 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn and KeyDisplay parameter to /web/entry/en/address/adrsSetUserWizard.cgi.