[ insider_reports_insider ]
Big Yellow Big Problem For Symantec
David Utter
Staff Writer
2006-12-18
 Insider Reports RSS Feed
A worm discovered by security firm eEye exploits a vulnerability in Symantec's software that unwary administrators may have left unpatched.
 | | Big Yellow Big Problem For Symantec |  |
The potential for exploitation of the problem in the remote management interface for Symantec's AntiVirus and Client Security products could go as far as permitting remote code execution with system privileges.
eEye caught a sample of the worm on December 14th.
The firm dubbed the worm Big Yellow, a play on the dominant color in Symantec's corporate color scheme and a fixture in its advertising efforts. Big Yellow's impact may have been mitigated before its emergence, though.
Researchers at eEye provided a technical analysis of the worm, which is being driven by a botnet.
They noted how it is connecting back to a bot controller, and cited the need for administrators to ensure their version of Symantec is up to date.
They also specified port tcp/2967 as the one the worm attempts to use to contact Symantec's Rtvscan.exe. "The exploit request is contained within the worm's SVCHOST.EXE," said eEye.
Back in May 2006, eEye worked with Symantec to build a patch for the vulnerability affected by Big Yellow.
There is some concern that an enterprise that has not applied this patch, for whatever reason, could be at risk.
The creation of the worm by parties unknown six months after the release of the patch highlights the continuing shift of attacks from the operating system to the applications running on that system.
"Given the rapid discovery of critical security vulnerabilities within desktop applications other than Microsoft, the release of malware of this magnitude targeting non-Microsoft software was only a matter of time," said Marc Maiffret, eEye's founder and CTO.
"IT urgently needs to understand that the new vector for attack will not come from Microsoft, but from the myriad applications that are scattered throughout its network."
---
Tag: Big Yellow
Add to  Del.icio.us |  Digg |  Reddit |  Furl
Get all the updates - 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
