Symantec Vulnerability Revealed
EEye Digital Security uncovers remotely exploitable vulnerability in Symantec anti-virus program
EEye Digital Security revealed this afternoon a software vulnerability inside Symantec's Anti-Virus Corporate Edition 10.0.
The vulnerability warning, posted on the vendor's Upcoming Advisories page, requires no user intervention and could be used to create a worm. A Symantec representative told Dark Reading that eEye notified Symantec of the problem today and it is investigating the issue.
Marc Maiffret, eEye's co-founder and chief hacking officer, said, "Symantec hasn't gotten back to us with a timeline yet, but they are very responsive to vulnerability reporting and quickly fix problems compared to other vendors we work with, like Microsoft."
EEye also tested Symantec's consumer security suite, Norton Internet Security 2006, which eEye uses, and found that it was not vulnerable. "We don't know how many other Symantec products are affected because of bundling," Maiffret said. "But with Symantec's large deployment footprint, a worm could spread fast."
Since the problem affects Symantec's Corporate Edition and is remotely exploitable, some experts deduced that the problem may lie with the software that handles centralized management. However, this could not be confirmed with eEye or Symantec.
According to eEye, its researchers were working to integrate its host protection product, Blink, with Anti-Virus Corporate Edition and decided to test the application. To eEye's surprise, it took little more than a week to find the vulnerability and create a working exploit.
Maiffret thinks the ease and speed of finding an exploitable bug may indicate development problems in Symantec. "Finding exploitable bugs in security software is bad enough, but finding generic problems like stack-based buffer overflow indicates systemic issues. Using secure development practices is costly for small developers, but a billion-dollar company like Symantec can afford it."
— Mike Fratto, Editor at Large, Dark Reading
Organizations mentioned in this story:
Symantec Corp. (Nasdaq: SYMC)
About the Author
You May Also Like
Transform Your Security Operations And Move Beyond Legacy SIEM
Nov 6, 2024Unleashing AI to Assess Cyber Security Risk
Nov 12, 2024Securing Tomorrow, Today: How to Navigate Zero Trust
Nov 13, 2024The State of Attack Surface Management (ASM), Featuring Forrester
Nov 15, 2024Applying the Principle of Least Privilege to the Cloud
Nov 18, 2024