Symantec anti-virus flaw hits 30 products
Updates issued for critical bug, calamity averted
Posted in Malware, 10th February 2005 11:26 GMT
Free whitepaper – Solid State Drives and High-Speed Memory
A cross-platform flaw affecting many Symantec security products - both consumer and enterprise - has been discovered. Users of Symantec's Norton SystemWorks 2004, Norton SystemWorks 2004 (both Mac and Windows), Norton AntiVirus 2004, corporate anti-virus apps and Brightmail anti-spam software (among others) all need to apply patches following the discovery of the "highly critical" security bug. In all 30 packages are affected.
The vulnerability stems from a flaw in an antivirus scanning component (called the DEC2EXE parsing engine) involving the processing of UPX compressed files. Maliciously constructed UPX files could be created to cause a heap-based buffer overflow. This in turn makes it possible for malicious hackers to inject hostile code onto vulnerable systems, allowing them to be taken over by attackers.
Symantec said the vulnerable EC2EXE engine is no longer required to parse compressed files. It had already planned to dispense with the component across its product range and the discovery of vulnerability by security tools vendor ISS has simply brought forward this process. Update details are here. ISS's alert is here. ®
Related stories
Freegate is not Trojan horse, says Symantec
Red alert over Symantec firewall flaw
Scripting flaws threaten Norton software
McAfee app raids Mac users' inboxes
McAfee to eradicate app assassin bug
Register Research on: Application Platforms
The Register Guide to email security
The Register 2007 Tech Barometer
The Register's Green Computing Debate
Linux on the Desktop
