Symantec over the weekend delivered fixes for a high-profile flaw in its corporate antivirus products that could be exploited in an Internet worm attack.
Users of Symantec AntiVirus Corporate Edition and Symantec Client Security should apply the appropriate update as soon as possible, Vincent Weafer, a senior director at Symantec Security Response, said on Tuesday. However, because there are no known attacks that exploit the flaw, the need to patch is not urgent, he added.
The vulnerability was initially reported last week by eEye Digital Security. The flaw, a remotely exploitable buffer overflow, could potentially allow an attacker to run malicious code on a vulnerable computer. Because Symantec's software is so widely used, this could cause havoc on the Internet — for example, if a worm were to exploit the problem.
Recognising the urgency to deliver a fix, Symantec worked over the weekend — a holiday weekend in the US — to deliver patches. "Since it was publicly reported, we did have to go into emergency mode and deliver patches for the products," Weafer said.
Ubiquitous antivirus software is like low-hanging fruit to hackers, analysts have said. As the pool of easily exploitable Microsoft Windows bugs dries up, attackers are looking for holes in security software to break into PCs. Symantec realises this, Weafer said.
"More eyes are looking for these vulnerabilities," he said. "This is clearly something we're going to look at ourselves. We can use this as a lesson to determine if there is any change needed to our secure programming."
Symantec has fixes available for the English-language versions of its products. The company is still working on updates for versions in other languages. The products affected by this security issue are Symantec AntiVirus Corporate Edition version 10.x and Symantec Client Security version 3.x, though other versions may also be affected.
