Simply edit the "Buffer Overflow Protection Policies" policy and uncheck "Enable buffer overflow protection". After that, wake up your systems to pull the changes.
thnx for the update, normally i'm not on ePO so i didn't find any solutions, i tried your solution. But it didn't work until i enforced the policies. There was not 1 policy enforced.
So my last question.. What is the exact use of enforcement? ( is it the same as "apply" ?)
This is a new issue with P4 of VSE 8.8
I would suggest you to open a suport case for this for more help.Message was edited by: neeraj_vats on 2/24/14 3:14:55 AM CST
No issues reported with my first test batch of 30 machines, although we have HIPS which I think disabled the VSE BOP as the HIPS version is better/more advanced.
can any of you confirm if you have HIPS installed on these machines with issues or just VSE?
i'm having the same problem actually... But only XP clients are affected (using for exemple MS Office...)
i was forced to disable BOP....
@Pierce: i confirm, isaw in the McAfee documentation that using HIPS was disabling VSE BOP...
It seems like the Problem is with Office 2010 too.. any suggestions?
I can Reproduce the Problem on XP with Office 2007 & 2010.
Installed Product on XP Client:
McAfee Agent 220.127.116.110, Product Coverage Reports 18.104.22.1680, SiteAdvisor Enterprise Plus 22.214.171.1243, Rogue System Detection 126.96.36.1992, Product Improvement Program 188.8.131.526, VirusScan Enterprise 184.108.40.2067
Dat = 7356.0000
Epo Master Repository :
Extentions VirusScan Enterprise:
I have the same Problem - since VSE 8.8 P4 all XP Systems in my company hooks on the Problem. When ever someone is closeing an Office Programm there will be the failure of an Buffer overflow.. to preseve the Database for log Storm i decide to edit ans Disable the policy, but - THAT cant be the last word. !!!!
Im not shure but it seems that it has somthing to do with the realtime engine. I am realy pissed of - every time i decide to upgrade McAfee - it makes Problems. That sucks! Mcafee is more and more unlikly for fine business. But i was happy that the EPO upgrade from 5.01 to 5.1 was done without problems. *puh i was so lucky ! no crashing!*
But there are so many walls in the workflow too.. stuff since Epo 4.0 that has never come. I am still waiting for a simple button that allows me to install or Uninstall or Repair the VSE on a client by setting a hook and click: Install VSE. I cannot understand why mcafee does it for the agents but NOT for the scanengine. Thats so ARRG frustrating.. installing and uninstalling by using roles and Policy updates is not a nice workflow. Shure i can drag and drop a client to a other folder that has the Policy to install the VSE (or uninstall). But it needs to update ALL of the policy.. and wait til it has all policy - until it looks for the different Tasks to run. Is so hard to implement: "Klick -> (re)install & Repiar VSE.."
I also have the Problem, that since the EPO 5.1 is installed - the Agent wakeup and update tasks going to run endless. EPO dont realize that the Systems are offline. So i need to kill the Task manually. That seems to me like a bug too.
If there is any working hotfix for those problems please PLEASE let me know.
I`ve the same problem with VSE8.8 Patch 4 and BOP alarms. Have talked to McAfee support. They know the problem and working on a solution. A hotfix for this problem should be ready till end of the week.
Workaround: Disable BOP
In testing SP4 so far I've seen BOP alerts on an XP machine running Office 2003 SP2. The alert specifically was for Winword.exe. This appears to have been resolved when I upgraded to Office 2003 SP3.