McAfee Intrusion Prevention and Security Risk Management Solutions Provide Protection to Identify and Block Potential New AttacksSANTA CLARA, Calif., Feb. 13 /PRNewswire-FirstCall/ McAfee, Inc. (NYSE: MFE) announced that it provides coverage for the 20 security vulnerabilities disclosed by Microsoft Corporation today. These vulnerabilities have been reviewed by McAfee® Avert® Labs, and based on their findings, McAfee recommends that users confirm the Microsoft product versioning outlined in the bulletins and update as recommended by Microsoft and McAfee. This includes deploying solutions to ensure protection against the vulnerabilities outlined in this advisory.
"Today Microsoft patched six vulnerabilities that were previously used in recent targeted zero-day attacks," said Dave Marcus, security research and communications manager, McAfee Avert Labs. "This continues the trend of malware authors targeting widely deployed Microsoft business applications and services. Malware authors continue to find unknown or unpatched vulnerabilities in popular applications and services which are then used in zero-day attacks, putting both business and consumer data at risk."
Microsoft Vulnerability Overview:
* MS07-005 - Vulnerability in Step-by-Step Interactive Training Could Allow Remote Code Execution
* MS07-006 - Vulnerability in Windows Shell Could Allow Elevation of Privilege
* MS07-007 - Vulnerability in Windows Image Acquisition Service Could Allow Elevation of Privilege
* MS07-008 - Vulnerability in HTML Help ActiveX Control Could Allow Remote Code Execution
* MS07-009 - Vulnerability in Microsoft Data Access Components Could Allow Remote Code Execution
* MS07-010 - Vulnerability in Microsoft Malware Protection Engine Could Allow Remote Code Execution
* MS07-011 - Vulnerability in Microsoft OLE Dialog Could Allow Remote Code Execution
* MS07-012 - Vulnerability in Microsoft MFC Could Allow Remote Code Execution
* MS07-013 - Vulnerability in Microsoft Rich Edit Could Allow Remote Code Execution
* MS07-014 - Vulnerabilities in Microsoft Word Could Allow Remote Code Execution
* MS07-015 - Vulnerabilities in Microsoft Office Could Allow Remote Code Execution
* MS07-016 - Cumulative Security Update for Internet Explorer
Scope of Potential CompromiseToday's 12 security bulletins cover a total of 20 vulnerabilities. Among the vulnerabilities, 13 are rated critical by Microsoft due to their potential for remote code execution. McAfee Avert Labs worked with Microsoft to responsibly disclose and patch the MS07-015 (CVE 2007 - 0671) vulnerability in Excel (for details visit http://www.avertlabs.com/research/blog/?p=199).
For additional information on today's vulnerabilities, as well as information on current threats, visit McAfee's Threat Center at http://www.mcafee.com/us/threat_center/default.asp where you will find blogs http://www.avertlabs.com/research/blog/ from McAfee Avert Labs researchers. More information on the vulnerabilities can also be found at http://www.microsoft.com/technet/security/current.aspx
McAfee SolutionsWith McAfee's security risk management approach, customers can effectively address business priorities and security realities. McAfee's award-winning solutions identify and block known and unknown attacks before they can cause damage. McAfee will continue to update its coverage as needed as new exploit vectors are discovered and new threats emerge.
Out of the box, Host IPS protects against many buffer overflow exploits. McAfee Host IPS v6.0 and McAfee Entercept® protect users against code execution that may result from common classes of exploits targeted at the buffer overflow/overrun vulnerabilities in Step-by-Step Interactive Training, Windows Shell, Windows Image Acquisition Service, HTML Help ActiveX Control, Microsoft Data Access Components, Microsoft OLE Dialog, Microsoft MFC, Microsoft RichEdit, Microsoft Word, Microsoft Office, and Internet Explorer. This "out of the box" protection is provided without the need for security content updates for either product.
The McAfee Vulnerability Shield package for McAfee Host IPS v6.0 customers provides specific protection against common classes of exploits targeted at the vulnerabilities in Step-by-Step Interactive Training, Windows Shell, Windows Image Acquisition Service, HTML Help ActiveX Control, Microsoft Data Access Components, Microsoft Word, and Internet Explorer. Coverage for Microsoft OLE Dialog, Microsoft MFC, and Microsoft RichEdit is available to protect WordPad from exploitation. McAfee's Vulnerability Shield package is deployed through McAfee ePolicy Orchestrator® to agents to protect systems without rebooting.
McAfee VirusScan® Enterprise 8.0i and McAfee Managed VirusScan with AntiSpyware protect users against code execution that may result from common classes of exploits targeted at the buffer overflow/overrun vulnerabilities in Windows Shell, Windows Image Acquisition Service, HTML Help ActiveX Control, Microsoft Data Access Components, Microsoft Word, Microsoft Office, and Internet Explorer. Coverage for Microsoft OLE Dialog, Microsoft MFC, and Microsoft RichEdit is available to protect Microsoft Word from exploitation.
McAfee IntruShield® provides coverage for Step-by-Step Interactive Training, Microsoft Malware Protection Engine, Microsoft OLE Dialog, Microsoft MFC, Microsoft RichEdit, Microsoft Word, and Internet Explorer vulnerabilities through signature sets released today. Coverage was provided in previous signature sets for Microsoft Data Access Components and Microsoft Office vulnerabilities. McAfee IntruShield sensors deployed in in-line mode can be configured with a response action to drop such packets for preventing these attacks.
The McAfee System Compliance Profiler, a component of McAfee ePolicy Orchestrator, is being updated for today's newly disclosed vulnerabilities in Step-by-Step Interactive Training, Windows Shell, Windows Image Acquisition Service, HTML Help ActiveX Control, Microsoft Data Access Components, Microsoft OLE Dialog, Microsoft MFC, Microsoft RichEdit, Microsoft Word, Microsoft Office, and Internet Explorer to quickly assess compliance levels of the security patches announced today.
The McAfee Foundstone® and McAfee Policy Enforcer checks are being created to detect the vulnerabilities announced today, and will be available in the packages released today and the day after tomorrow, respectively. These checks are expected to accurately identify if a system is vulnerable in many enterprise environments.
McAfee Hercules® Policy Auditor compliance checks and McAfee Hercules® Remediation Manager remediations are being created to identify unpatched systems and apply the necessary patches to affected systems for the vulnerabilities in Windows Shell, Windows Image Acquisition Service, HTML Help ActiveX Control, Microsoft Data Access Components, Microsoft OLE Dialog, Microsoft MFC, Microsoft RichEdit, Microsoft Word, Microsoft Office, and Internet Explorer. Updates will be available in the next V-Flash package which will be released today.
Avert DAT files have already been released to detect known exploits and new detection will be added as new exploits are discovered. DAT files are used by McAfee GroupShield®, PortalShieldTM, Secure Internet Gateway appliances, Secure Messaging Gateway appliances, Secure Web Gateway appliances, Total Protection suites, VirusScan Enterprise, VirusScan Command Line, VirusScan Online and other McAfee scanners. McAfee users can refer to www.mcafee.com/us/threat_center/default.asp for information regarding any new threats attempting to exploit these vulnerabilities.
McAfee Avert Labs maintains one of the top-ranked security threat and research organizations in the world, employing researchers in 16 countries around the globe. The Labs combine world-class malicious code and anti-virus research with intrusion prevention and vulnerability research expertise. McAfee protects customers by providing deep analysis and core technologies that are developed through the combined efforts of its researchers. McAfee Avert Labs continually monitors the Internet for new threats and attack vectors on a daily basis. Whenever possible, we will update our security technologies and coverage as these new threats and vectors emerge.
About McAfee, Inc.McAfee Inc., the leading dedicated security technology company, headquartered in Santa Clara, California, delivers proactive and proven solutions and services that secure systems and networks around the world. With its unmatched security expertise and commitment to innovation, McAfee empowers home users, businesses, the public sector, and service providers with the ability to block attacks, prevent disruptions, and continuously track and improve their security. www.mcafee.com
NOTE: McAfee, Avert, IntruShield, Entercept, Foundstone, ePolicy Orchestrator, VirusScan, GroupShield, PortalShield, and Hercules are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the United States and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners. © 2006 - 2007 McAfee, Inc. All Rights Reserved.
SOURCE McAfee, Inc. |