Users of Symantec AntiVirus Corporate Edition and Symantec Client Security should apply the appropriate update as soon as possible, Vincent Weafer, a senior director at Symantec Security Response, said Tuesday. However, because there are no known attacks that exploit the flaw, the need to patch is not urgent, he added.
The vulnerability was initially reported last week by eEye Digital Security. The flaw, a remotely exploitable buffer overflow, could potentially allow an attacker to run malicious code on a vulnerable computer. Because Symantec's software is so widely used, this could cause havoc on the Internet--for example, if a worm were to exploit the problem.
Recognizing the urgency to deliver a fix, Symantec worked over the weekend--a holiday weekend in the U.S.--to deliver patches. "Since it was publicly reported, we did have to go into emergency mode and deliver patches for the products," Weafer said.
Ubiquitous antivirus software is like low-hanging fruit to hackers, analysts have said. As the pool of easily exploitable Microsoft Windows bugs dries up, attackers are looking for holes in security software to break into PCs. Symantec realizes this, Weafer said.
"More eyes are looking for these vulnerabilities," he said. "This is clearly something we're going to look at ourselves. We can use this as a lesson to determine if there is any change needed to our secure programming."
Symantec has fixes available for the English versions of its products. The Cupertino, Calif., company is still working on updates for international versions. The products affected by this security issue are Symantec AntiVirus Corporate Edition version 10.x and Symantec Client Security version 3.x.
