X

Symantec patches antivirus worm hole

Company works through the holiday weekend to fix hole in corporate antivirus products that could let a worm spread.

Joris Evers Staff Writer, CNET News.com
Joris Evers covers security.
Joris Evers
2 min read
Symantec over the weekend delivered fixes for a high-profile flaw in its corporate antivirus products that could be exploited in an Internet worm attack.

Users of Symantec AntiVirus Corporate Edition and Symantec Client Security should apply the appropriate update as soon as possible, Vincent Weafer, a senior director at Symantec Security Response, said Tuesday. However, because there are no known attacks that exploit the flaw, the need to patch is not urgent, he added.

The vulnerability was initially reported last week by eEye Digital Security. The flaw, a remotely exploitable buffer overflow, could potentially allow an attacker to run malicious code on a vulnerable computer. Because Symantec's software is so widely used, this could cause havoc on the Internet--for example, if a worm were to exploit the problem.

Recognizing the urgency to deliver a fix, Symantec worked over the weekend--a holiday weekend in the U.S.--to deliver patches. "Since it was publicly reported, we did have to go into emergency mode and deliver patches for the products," Weafer said.

Ubiquitous antivirus software is like low-hanging fruit to hackers, analysts have said. As the pool of easily exploitable Microsoft Windows bugs dries up, attackers are looking for holes in security software to break into PCs. Symantec realizes this, Weafer said.

"More eyes are looking for these vulnerabilities," he said. "This is clearly something we're going to look at ourselves. We can use this as a lesson to determine if there is any change needed to our secure programming."

Symantec has fixes available for the English versions of its products. The Cupertino, Calif., company is still working on updates for international versions. The products affected by this security issue are Symantec AntiVirus Corporate Edition version 10.x and Symantec Client Security version 3.x.