McAfee Security Bulletin - March 17, 2005

Sep 17, 2026

Upload by Elsa

McAfee announces that customers running VirusScan Engine version 4320 are susceptible to buffer overflow issues when scanning LHa files. The bulletin explains two related vulnerabilities (CAN-2005-0643 and CAN-2005-0644) and identifies affected products using the 4320 engine with insufficient DAT versions. It states that no known public exploit code exists as of publication. Recommended actions include updating DAT files and upgrading to Scan Engine 4400, plus guidance on verifying Engine and DAT versions in enterprise environments.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages3

Reading Time8 min

AccessFree to download

Overview

Summary of Vulnerabilities

CAN-2005-0643-McAfee Engine Buffer Overflow when scanning LHa files

CAN-2005-0644-Engine Buffer Overflow when scanning malformed LHa files

Products Affected

Recommendations

For McAfee Consumer Customers

For McAfee SMB and Enterprise Customers

How do I check Engine & DAT Versions within Enterprise Products?

Security Bulletin March 17, 2005 McAfee Security Bulletin Overview McAfee is announcing to its’customers who are operating on a previous version of the McAfee VirusScan Engine (version 4320) are susceptible to a buffer overrun when scanning LHa files. • No action is required if your environment is currently running the 4400 Scan Engine (issued November 2004) or the Virus Definition (DAT) version is 4436 (issued March 1, 2005) or higher McAfee strongly encourages all McAfee customers to read the following bulletin and, if necessary, implement the recommendations listed below as soon as possible. The automatic downloading and installation of updates and upgrades as a default setting in VirusScan assures the delivery of the latest product version to our customers. We urge all customers to verify that they have installed and deployed the 4436 DAT [or higher] and/or the 4400 Scan Engine. If running an earlier . DAT and the previous version of the McAfee VirusScan engine (4320), McAfee recommends that an update is performed. As of the writing of this security bulletin, there are no known public cases of exploit code that exist. Summary of Vulnerabilities CAN-2005-0643-McAfee Engine Buffer Overflow when scanning LHa files A vulnerability announcement in May 2004 prompted McAfee to inspect our technology to determine the susceptibility to the potential exploit. This inspection determined that the 4320 version of the McAfee Scan Engine was susceptible to a buffer overflow when scanning LHa files. An alteration to the configuration of the Scan Engine issued with the 4357 DAT file (issued May 2004) was made to eliminate the vulnerability within the 4320 Scan Engine. Products affected: Scan Engine 4320 – any McAfee point products still using the 4320 engine and DAT version less than 4357. CAN-2005-0644-Engine Buffer Overflow when scanning malformed LHa files In February 2005, a variation of this vulnerability was reported to McAfee by ISS X-Force. It was found that the 4320 version of the McAfee Scan Engine was susceptible to a buffer overflow when scanning malformed LHa files. An alteration to the configuration of the Scan Engine issued (March 1, 2005) with the 4436 DAT file was made to eliminate the vulnerability within the 4320 Scan Engine. The McAfee 4400 engine (issued November 2004) does not have this vulnerability. Products affected: Scan Engine v.4320 – any McAfee point products still using the 4320 engine and DAT version less than 4436. The following McAfee products and suites may include the vulnerable engine (4320) . McAfee Consumer Products: − McAfee InternetSecurity Suite − VirusScan (all versions) − VirusScan Professional McAfee SMB and Enterprise Products: − Active Mail Protection − Active Threat Protection − Active Virus Defense SMB Edition − Active VirusScan SMB Edition − GroupShield for Exchange − GroupShield for Exchange 5.5 − GroupShield for Lotus Domino − GroupShield for Mail Servers with ePO − LinuxShield − Managed VirusScan − NetShield for Netware − PortalShield for Microsoft SharePoint − SecurityShield for Microsoft ISA Server − Virex − VirusScan ASaP − VirusScan Command Line − VirusScan® Enterprise 8.0i − VirusScan for NetApp − WebShield Appliances − WebShield SMTP Recommendations For McAfee Consumer Customers: McAfee strongly recommends customers to download and apply the latest . DAT files and the latest Scan Engine (v.4400) . No action is required if the Scan Engine version is 4400 or the DAT version is 4436 (issued March 1 2005) or higher. Consumers can update their software by right-clicking on their system tray icon (white M on Red background) and selecting “Updates”. More information is available at: [http://ts.mcafeehelp.com/faq3.asp?docid=378097](http://ts.mcafeehelp.com/faq3.asp?docid=378097) . For McAfee SMB and Enterprise Customers: To address the above vulnerabilities, McAfee strongly recommends customers to do

FAQs

Who is susceptible according to the bulletin?

Customers operating on the previous McAfee VirusScan Engine version 4320 are susceptible when scanning LHa files. If the environment already runs Scan Engine 4400 or a DAT version of 4436 (or higher), no action is required.

What vulnerabilities are summarized in this bulletin?

The bulletin summarizes CAN-2005-0643 (engine buffer overflow when scanning LHa files) and CAN-2005-0644 (engine buffer overflow when scanning malformed LHa files). Both issues involve susceptibility in engine version 4320 and are addressed by configuration changes delivered via later DAT files.

What updates does McAfee recommend?

McAfee recommends downloading and applying the latest DAT files and the latest Scan Engine (v.4400). It also urges customers to verify deployment of DAT 4436 (or higher) and/or the 4400 Scan Engine, with no action required if those versions are already in place.

Sep 17, 2026

Upload by Elsa