Jon Tydda
Jon.Tydda at alcontrol.co.uk
Fri Feb 11 03:21:37 CST 2005
Sorry for the cross post, but I thought this was worth it... Symantec anti-virus flaw hits 30 products By John <http://forms.theregister.co.uk/mail_author/?story_url=/2005/02/10/symantec_ uberbug/> Leyden Published Thursday 10th February 2005 11:26 GMT A cross-platform flaw affecting many Symantec security products - both consumer and enterprise - has been discovered. Users of Symantec's Norton SystemWorks 2004, Norton SystemWorks 2004 (both Mac and Windows), Norton AntiVirus 2004, corporate anti-virus apps and Brightmail anti-spam software (among others) all need to apply patches following the discovery of the " highly critical <http://secunia.com/advisories/14179/> " security bug. In all 30 packages are affected. The vulnerability stems from a flaw in an antivirus scanning component (called the DEC2EXE parsing engine) involving the processing of UPX compressed files. Maliciously constructed UPX files could be created to cause a heap-based buffer overflow. This in turn makes it possible for malicious hackers to inject hostile code onto vulnerable systems, allowing them to be taken over by attackers. Symantec said the vulnerable EC2EXE engine is no longer required to parse compressed files. It had already planned to dispense with the component across its product range and the discovery of vulnerability by security tools vendor ISS has simply brought forward this process. Update details are here <http://www.sarc.com/avcenter/security/Content/2005.02.08.html> . ISS's alert is here <http://xforce.iss.net/xforce/alerts/id/187> . In case the links don't work, here they are: http://secunia.com/advisories/14179/ <http://secunia.com/advisories/14179/> http://www.sarc.com/avcenter/security/Content/2005.02.08.html <http://www.sarc.com/avcenter/security/Content/2005.02.08.html> http://xforce.iss.net/xforce/alerts/id/187 <http://xforce.iss.net/xforce/alerts/id/187> Jon The information in this e-mail is confidential and may also be legally privileged. The contents are intended for recipient only and are subject to the legal notice available on request from : webmaster at alcontrol.co.uk ALcontrol Laboratories is a trading division of ALcontrol UK Limited. Registered Office: Templeborough House, Mill Close, Rotherham, S60 1BZ. Registered in England and Wales No 4057291