Get three services for $100/mo
- Related Stories
-
F-Secure issues patch for critical flaws
January 19, 2006 -
Symantec closes off hiding place for hackers
January 11, 2006 -
Bug spotted in Symantec antivirus
October 5, 2005 -
Antivirus insecurity at Black Hat confab
July 27, 2005 -
Security tools face increased attack
June 20, 2005
Users of Symantec AntiVirus Corporate Edition and Symantec Client Security should apply the appropriate update as soon as possible, Vincent Weafer, a senior director at Symantec Security Response, said Tuesday. However, because there are no known attacks that exploit the flaw, the need to patch is not urgent, he added.
The vulnerability was initially reported last week by eEye Digital Security. The flaw, a remotely exploitable buffer overflow, could potentially allow an attacker to run malicious code on a vulnerable computer. Because Symantec's software is so widely used, this could cause havoc on the Internet--for example, if a worm were to exploit the problem.
Recognizing the urgency to deliver a fix, Symantec worked over the weekend--a holiday weekend in the U.S.--to deliver patches. "Since it was publicly reported, we did have to go into emergency mode and deliver patches for the products," Weafer said.
Ubiquitous antivirus software is like low-hanging fruit to hackers, analysts have said. As the pool of easily exploitable Microsoft Windows bugs dries up, attackers are looking for holes in security software to break into PCs. Symantec realizes this, Weafer said.
"More eyes are looking for these vulnerabilities," he said. "This is clearly something we're going to look at ourselves. We can use this as a lesson to determine if there is any change needed to our secure programming."
Symantec has fixes available for the English versions of its products. The Cupertino, Calif., company is still working on updates for international versions. The products affected by this security issue are Symantec AntiVirus Corporate Edition version 10.x and Symantec Client Security version 3.x.
See more CNET content tagged:
Symantec Corp.,
Symantec AntiVirus,
antivirus,
fix,
flaw
Somebody please give Vincent Weafer some lessons in PR.
it's expected that the company i'd pay for software security would be on their toes and taking care of any concerns irregardless if it's immediate or not.
Luckily, Symantec hasn't felt what Sony is feeling right now (yet). Hit the panic button when necessary. It's a sunny summer now.