full-disclosure - Mcafee VSO (Virus scanner)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <004001c370d0$d3df2170$0100a8c0@p3600>
From: chows at ozemail.com.au (gregh)
Subject: Mcafee VSO (Virus scanner)

Problem:
--------

Approximately 2 weeks ago from this date (Sept 2), Mcafee put their VSO version scanner through a major update. Included in that update was the ability for VSO to do more for mail scanning than it previously used to do. It now has the ability to watch email come in via contacting the mail server at the same time as, say OE if that is your email program of choice. In doing so, it causes time-out errors which result in, depending on the amount of email you are receiving, either the email list not able to be downloaded without continual attempts or, as is also common, the entire email waiting being downloaded and then cutting off OE from telling the server to delete the email picked up. The result of that is obviously that you will get duplicated, or more, email.

Though Mcafee add the option to disallow Email scanning by removing ticks in those spots, it has no effect on stopping this problem happening.

Reported as a problem:
-----------------------

Approximately Aug 26th through their online reporting function. To date, no response.

Workaround:
-------------

Fortunately, you need only block, even with a simple software firewall such as Zone Alarm, "Mcafee Virusscan Email Module" from contacting Internet and it completely overcomes the abovementioned problem. 

Of interesting note is that the module actually shows itself to be part of a Mcafee virus scanning program that is much older than VSO and has no part in it of which I am aware yet it actually IS part of VSO, having been installed with the recent update of approximately 2 weeks ago.

Greg.