[ insider_reports_insider ]
Bot Attacks Old Symantec Flaw
David Utter
Staff Writer
2006-11-29
 Insider Reports RSS Feed
An issue with Symantec Client Security and its Antivirus Corporate Edition had to be fixed after a bot program began exploiting it at universities.
 | | "Whats really going on in there..." |  |
The bot program, dubbed W32.Spybot.ACYR by Symantec, can also exploit five recently patched vulnerabilities in Microsoft Windows. The SecurityFocus website reported that while the bot could creep past Symantec's products, the company's consumer AV software sold under the Norton name did not contain the same flaw.
Symantec has since updated its signatures to identify the bot when it attempts to exploit the six-month-old flaw, according to SecurityFocus editor Robert Lemos.
The bot may have compromised over a thousand systems, based on assessments of network traffic recorded by SANS Internet Storm Center and Indiana University's REN-ISAC project. The bot attempted to hit port 2967 to exploit the Symantec flaw.
Its spread affected systems at the University of New South Wales in Australia, and the University of Arkansas. The report cited a security analyst from the University of Arkansas in explaining why these threats are a bigger problem for colleges:
As university environments are very decentralized, group policies and other mechanisms used to keep software up-to-date and well managed, may or may not exist. So one department may have completed the upgrades, when the office next door is still using a much older version.
That decentralization has been largely eliminated in the corporate sector, where IT departments tend to try and unify as much software management as possible due to the greater number of systems they must manage.
The Symantec flaw must be especially galling to those larger customers who implemented it for this purpose. However, an upgrade has been available for several months, so any manager who has been lax in implementing the update could be in for a rough morning in a superior's office.
---
Tag: Symantec
Add to  Del.icio.us |  Digg |  Reddit |  Furl
Get all the updates - 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
