Symantec releases Norton AntiVirus 10.0.2, plugs security holes

Symantec has released Norton AntiVirus 10.0.2.

The latest release contains security enhancements for the following components:

• SmallScanner
• DiskMountNotify

and includes an update to to the Auto-Protect component.

Specifically, the security update to the DiskMountNotify component includes a fix for a potential vulnerability where the software does not set its execution path environment. Hence a non-privileged user can change their execution path environment. If the user then executes the DiskMountNotify component, it will inherit the changed environment and use it to locate system commands. The DiskMountNotify is configured to run with System Administrative privileges (SUID) and is vulnerable to a potential Trojan horse attack.

The new release is available through the Symantec LiveUpdate mechanism.

Resources