bugtraq - Re: Virus Scan Attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <E34F2435A3EBE743B34CFF3F0279423F0119F6D9@beta.internal.3t.co.uk>
Date: Tue, 22 Jun 2004 13:27:41 +0100
From: "Paul Knibbs" <pknibbs@...co.uk>
To: <bugtraq@...urityfocus.com>
Subject: Re: Virus Scan Attack

This isn't a DoS as such. The problem occurs because the 4.1.60 scan
engine for McAfee products isn't compatible with the 4367 DATs. In order
to use these DATs you have to update your scan engine, which probably
requires disabling WebShield and running the SuperDAT updater--this is
what I had to do with our Exchange server (running GroupShield)
yesterday morning!

Nate Nord wrote:
> Just wondering if anyone else has seen this come through their mail
portal.
> Something has caused our McAfee Webshield SMTP to seriously eat 
> processor time... to the point that it will no longer forward scanned 
> mail.  I've had to temporarily bypass it until I figure out what it's 
> choking on.  I saw several other posts that said this sent processors 
> into some kind of loop and this is exactly what appears to be
happening with our portal.
> 

Paul Knibbs
Systems Administrator
3T Productions Ltd
T: 0161 492 1400  F: 0161 492 1401
www.3t.co.uk