F-Secure flaw opens door to intruders

Serious security hole in firm's antivirus products could let intruders launch a buffer overflow attack or spy on confidential information.

F-Secure has released a patch for a serious flaw in its antivirus products, the second time this week a security company has warned of a risk in its software.

The security hole in the antivirus library affects 18 products for desktops, servers and gateways, with the network products at "critical" risk, F-Secure said in a bulletin Thursday. By creating a specially crafted ARJ archive file, an intruder could use a buffer overflow to run arbitrary code on an unpatched machine, said Tony Magellanez, a systems engineer at F-Secure.

"At this point, it's a theoretical exploit," Magellanez said, noting that Internet Security Systems, which discovered the flaw, had not provided F-Secure with an example of malformed ARJ code. "ISS gave us details of how it could be done, and we created a patch."

The vulnerability could enable intruders to spy on confidential company information, ISS said in its advisory. It noted that several large vendors and Internet security providers use the antivirus library in their products.

F-Secure is urging all customers to apply the patch. Magellanez said businesses with managed security could use the policy manager to automatically send the update to individual users' machines. The fix has already been distributed to ISPs so they can get it out to members, Magellanez said.

On Tuesday, security software maker Symantec alerted its customers to a vulnerability in its own antivirus library, also found by ISS. The scanning software flaw, which affects the majority of Symantec's antivirus and antispam products, could cause a virus to execute, rather than catch it.

Internet Security Systems could not immediately provide a representative to comment on the issue.

Featured Video
This content is rated TV-MA, and is for viewers 18 years or older. Are you of age?
Sorry, you are not old enough to view this content.

Microsoft enters the laptop game with the hybrid Surface Book

This powerful 13.5-inch laptop include Nvidia graphics and a new hybrid hinge.

by Dan Ackman