Patch in for McAfee holes

The vulnerabilities in SecurityCenter could have let intruders commandeer consumer PCs.

McAfee has patched flaws in its SecurityCenter software, pervasive technology found in all of its consumer products from VirusScan to Total Protection to its Internet Security Suite.

The company has sent out a SecurityCenter 7.0 update to address the vulnerabilities, which could allow intruders to gain remote control of PCs Systems if the user clicks on a link to a malicious Web site, according to a security bulletin posted by McAfee on Monday.

The problems relate to SecurityCenter 4.3 through 6.0.22, the company said. Consumers who prefer to stay with these older versions should expect to receive a security patch from McAfee on Wednesday. Enterprise versions of the software were not affected by the flaws, McAfee noted.

SecurityCenter is designed to provide people with information on the security status of their system with one click of a mouse. It is geared toward consumers and small businesses.

"SecurityCenter is a consumer product, so the level of defense is less than a corporate network," said Mike Puterbaugh, a spokesman for eEye Digital Security, which discovered and reported the flaw to McAfee.

eEye rates the vulnerabilities as "highly critical," due to its potential to allow remote execution of code. McAfee, however, rates the flaws as a "medium" threat, because it requires user intervention to take effect.

Consumers also tend to be less likely to install updates, unless they are clearly labeled as a security update, Puterbaugh said.

McAfee, which was notified by eEye of the SecurityCenter flaws on July 19, said it has yet to receive any reports of systems being compromised.

Some customers have complained that the SecurityCenter 7.0 update caused Microsoft ActiveSync to fail when they tried to sync up their handheld computers. McAfee is reviewing the matter, a company representative said.

The SecurityCenter vulnerabilities mark the second time this month McAfee has been notified by eEye of flaws in its software. Earlier this month, eEye announced it had found a flaw in McAfee's ePolicy Orchestrator, a centralized security management and monitoring console used by corporate customers. The flaw, which required no user interaction to exploit, was located in the Framework Service component of the console.

Featured Video
This content is rated TV-MA, and is for viewers 18 years or older. Are you of age?
Sorry, you are not old enough to view this content.

The WRT1900ACS is Linksys' new best Wi-Fi router to date

CNET editor Dong Ngo compares the new WRT1900ACS and the old WRT1900AC Wi-Fi routers from Linksys. Find out which one is better!

by Dong Ngo