The Tech Herald

McAfee to release patch for open-relay bug

by Steve Ragan - Jan 19 2012, 19:05

McAfee to release patch for open-relay bug.(IMG:J.Anderson)

In response to the discovery that their hosted (SaaS) Total Protection product is acting as a spam toolkit, the company said they will release a patch to address the issue.

In short, the issue is that McAfee’s Total Protection offering, which hosted for customers by the security firm itself and offered as a SaaS solution, allows an attacker to connect to port 6515 and use the compromised host to send spam. This open-relay vulnerability was exposed earlier this week by Keith & Annabel Morrigan, and their findings were confirmed by a researcher known online as Hinky Dink.

Headers taken from the impacted systems show a clear pattern, which can be hunted down by administrators who check proxy logs; in the examples below each of the systems pointed to residential IP addresses, and all of them were flagged as spamming.

 

1.1 62G3CP1 (McAfee Relay Server 5.2.1)

1.1 acer-86e9bf2e61 (McAfee Relay Server 5.2.3)

1.1 Alan (McAfee Relay Server 5.2.3)

1.1 BERCOBACKUP (McAfee Relay Server 5.2.1)

1.1 bill-2eb924946b (McAfee Relay Server 5.2.3)

1.1 billkayredsa-PC (McAfee Relay Server 5.2.3)

1.1 blackkbarbie-PC (McAfee Relay Server 5.2.1)

 

Virus Bulletin sums the situation up best:

“Of course, this has caused serious embarrassment for McAfee - not least because anti-malware solutions are supposed to prevent this from happening.”

For their part, McAfee got to the root of the issue rather quickly. According to a bulletin from McAfee, the firm has developed a patch that will instruct their “rumor” technology to ignore most incoming requests on port 6515. The updated version will show 5.2.3 patch 4.

“We have mitigating factors already in place that reduce risk, and a patch is coming to remediate any additional risk to our customers. The patch will be released on January 18 or 19, as soon as we have finished testing. Because this is a managed product, all affected customers will automatically receive the patch when it is released,” McAfee said.

Around the Web

Comment on this Story

comments powered by Disqus

From Autosaur.com

300 Miles From One Gallon And No, That’s Not A Typo

Imagine you’re in a bar and a guy walks up and asks if you’d be interested in buying a car t...

2015 Nissan Pathfinder Prices and Specs

Nissan has announced pricing and specs for the 2015 Nissan Pathfinder. The SUV, which is on ...

Miami ePrix Circuit Revealed

The FIA Formula E Championship has revealed the layout for the Miami ePrix circuit. Formula ...

Two DeLoreans And A Replica Jaguar C Type On Scottish Classic Car Run

The Kirkintilloch & District Classic Vehicle Club’s annual run to Glencoe in Scotland is...

NBA All-Star LeBron James Teams with Kia

NBA All-Star LeBron James has signed a deal with Kia to be the company’s first luxury ambass...