NOW READ THIS
("Security Advisory")
Go Back
Submitted by: Bill Hickey
NCVA List Master
NRT-0288 Symantec Patches "Highly Critical" Norton Flaw:
Symantec has warned that a bug in two ActiveX controls in Norton AntiVirus could allow an attacker to run unauthorized software on a victim's computer. Symantec has offered a patch to address the problem.
Security vendor Secunia rates the problem as "highly critical." The flaw is an "input validation" error, meaning that Norton does not properly check the data it receives to ensure that it cannot be mistaken for malicious commands.
The bug affects users of the 2006 versions of Norton AntiVirus, Norton Internet Security, and Norton SystemWorks. Norton Internet Security 2006, Anti-Spyware Edition, is also affected. Symantec advises users to run the program's LiveUpdate feature as soon as possible to download the patch. Symantec's enterprise products, AntiVirus Corporate Edition and Symantec Client Security are not affected by the bug.
Such ActiveX programming errors are common, but they can be "nasty" said Johannes Ullrich, chief research officer for the SANS Institute. "People don't code ActiveX as carefully as they should," he said. It is not clear how easy it will be to write attack code that takes advantage of the problem, but because Norton is so widely used, the flaw should be taken seriously, Ullrich added. "It's serious because potentially anybody that has Norton AntiVirus installed is now vulnerable ... Now all that has to happen is for them to visit a malicious web site."
(www.computerworld.com 09AUG07)
Last Modified: Saturday, 08-Sep-2007 07:49:37 EDT