[ insider_reports_insider ]
Symantec Antivirus Vulnerability Revealed
David Utter
Staff Writer
2006-05-26
 Insider Reports RSS Feed
A flaw in Symantec's Antivirus and Client Security products could leave the machines they are protecting subject to exploitation.
 | | Symantec Security Vulnerability Discovered |  |
A flaw in Symantec's Antivirus and Client Security products could leave the machines they are protecting subject to exploitation.
An advisory issued by the eEye security firm disclosed a high severity problem with Symantec's antivirus program. In the advisory, eEye said, "This flaw does not require any end user interaction for exploitation and can compromise affected systems, allowing for the execution of malicious code with SYSTEM level access."
A report by eWeek revealed Symantec had confirmed the existence of the problem:
"[Our] product security team has been notified of a suspected issue in Symantec AntiVirus 10.x. [We] are evaluating the issue now and, if necessary, will provide a prompt response and solution," a Symantec spokesperson said in a statement sent to eWEEK.
Symantec posted an advisory of the issue, and said it did not know of any customers being victimized through the exploit, or if any exploit code for the flaw is in the wild.
Customers using Norton software are not affected by this flaw, Symantec said. In a story posted at DarkReading, eEye noted that the problem affects the Corporate Edition of Symantec's antivirus program.
In discussing the flaw with DarkReading, eEye co-founder Marc Maiffret expressed confidence that Symantec would fix the problem quickly. But he also raised a concern about Symantec's development practices in the report:
Maiffret thinks the ease and speed of finding an exploitable bug may indicate development problems in Symantec. "Finding exploitable bugs in security software is bad enough, but finding generic problems like stack-based buffer overflow indicates systemic issues. Using secure development practices is costly for small developers, but a billion-dollar company like Symantec can afford it."
---
Tag: General
Add to  Del.icio.us |  Digg |  Yahoo! My Web |  Furl
Get all the updates in RSS: 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
