Symantec Antivirus Users At Risk Patch for Buffer Overflow Vulnerability Expected Today Sean Michael Kerner
Just in time for the holidays, Symantec's antivirus programs have been found to have a "highly critical" vulnerability for which there is currently
no patch.
The Symantec AntiVirus RAR Archive Decompression Buffer Overflow vulnerability could allow an attacker to gain control of a system. The vulnerability affects at least 39 different Symantec antivirus products, according to an advisory from security firm Secunia.
Secunia credits security researcher Alex Wheeler for discovering the flaw, which allegedly exists within the Symantec Antivirus library and could potentially allow for multiple heap (define) overflows when Symantec's products scan a malicious RAR archive.
A RAR archive is a compressed archive file (similar to a Zip file).
According to Wheeler's advisory, "These vulnerabilities can be exploited remotely without user interaction in default configurations through common protocols such as SMTP."
Users of Symantec's antivirus products are warned to disable scanning of RAR compressed files until such time as the vulnerable code has been patched.
As of Wednesday afternoon, Symantec is now claiming that it’s security response team has in fact posted an AntiVirus based protection signature to LiveUpdate providing a heuristic detection for potential exploits of the Symantec decomposer RAR archive vulnerability.
According to Symantec, the update signature is available to all desktop, server, and gateway product versions of Symantec's security products and appliance solutions that contain the decomposer RAR archive.
Symantec strongly recommends that customers immediately ensure their virus definitions are up to date to protect against any possible threat. To date, the company has not had any reports of related exploits of this issue.
Yet despite Symantec's statement, as of 3:30 p.m. EST, the company had not yet issued an advisory about the issue on its publicly available security response Web site.
According to a Symantec statement received by internetnews.com, "Information about specific product updates and mitigation will be posted to Symantec Security Response Web site later today."
