FYI- regarding Symantec Anti virus.

[S77th-konkussion]

http://www.foxnews.com/story/0,2933,197083,00.html

 

 

Huge Security Flaw Found in Leading Anti-Computer Virus Software

Friday , May 26, 2006

By Ryan Naraine

 

 

A gaping security flaw in the latest versions of Symantec's anti-virus software suite could put millions of users at risk of a debilitating worm attack, Internet security experts warned May 25.

Researchers at eEye Digital Security, the company that discovered the flaw, said it could be exploited by remote hackers to take complete control of the target machine "without any user action."

"This is definitely wormable. Once exploited, you get a command shell that gives you complete access to the machine. You can remove, edit or destroy files at will," said eEye Digital Security spokesperson Mike Puterbaugh.

"We have confirmed that an attacker can execute code without the user clicking or opening anything," Puterbaugh said.

eEye, based in Aliso Viejo, Calif., posted a brief advisory to raise the alarm about the bug, which can allow the execution of malicious code with system-level access.

The flaw carries a "high risk" rating because of the potential for serious damage, Puterbaugh said.

Symantec, of Cupertino, Calif., confirmed receipt of eEye's warning and said an investigation was underway.

"[Our] product security team has been notified of a suspected issue in Symantec AntiVirus 10.x. [We] are evaluating the issue now and, if necessary, will provide a prompt response and solution," a Symantec spokesperson said in a statement sent to eWEEK.

Symantec's anti-virus software is deployed on more than 200 million systems in both the enterprise and consumer markets, and the threat of a network worm attack is very real.

However, eEye's Puterbaugh said there are no publicly shared proof-of-concept exploits or other information to suggest an attack is imminent.

But, he said, "there's nothing to say that someone hasn't found this and is already using it for nefarious activities. ... It's quite possible that we weren't the only ones to find this. Who knows if it's already being used in targeted attacks that we'll never hear about."

Internet security experts have long warned that flaws in anti-virus products will become a big target for malicious hackers.

During the last 18 months, some of the biggest names in the anti-virus business have shipped critical software updates to cover code execution holes, prompting speculation among industry watchers that it's only a matter of time before a malicious hacker is motivated to create a devastating network worm using security software flaws as the attack vector.

"The big surprise is we haven't seen one yet," said Johannes Ullrich, chief technology officer at the SANS ISC (Internet Storm Center), of Bethesda, Md., in a recent eWEEK interview.

In March 2004, the fast-moving Witty worm exploited a zero-day buffer overflow in security products sold by Internet Security Systems.

Unlike most self-propagating worms, Witty was capable of corrupting the hard drives of infected machines, preventing normal operation of the PC and eventually causing it to crash.

"This could be Symantec's Witty," Puterbaugh warned.

The vulnerable Symantec 10.x application promises real-time detection and repairs for spyware, adware, viruses and other malicious intrusions. It is used by many of the world's largest corporate customers and U.S. government agencies.

Check out eWEEK.com's Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer's Weblog.

[Gunja]

good to know ;)

[Force_Feedback]

That's why I use Avira Antivir, better than Kaspersky and Symmantec, and free too.

[JaNk0]

No way, NOD32 ROCKS! :thumbsup:

[Guest IguanaKing]

I just copied and pasted this from the UBI forums. I'm too lazy to re-type it in different words.

========================================================

Different anti-virus software has different vulnerabilities. I can't say that I'd immediately rule out Norton, just because of that article. What it doesn't catch, someone else's software WILL...and vice versa.

 

BTW...I'm not a Norton fanboy. In fact, I have been using McAfee for years. Six of one, a half-dozen of the other.

[Witchking]

zone alarm security suite is amazing . good firewall....a game mode and so on. A lot lesser hog than Symantec.

[504MrWolf]

i havent used an AV for about a year, just keep XP updated and using Firefox has kept my pc clean.

 

google.com will tell you if you have anything dodgy on your pc as it wont let you use it ! :)

[Weta43]

Unless its just a keystroke logger sending your bank account details & passwords home :-)

[TucksonSonny]

That’s why you get upgrades on daily basis.

[Weta43]

I meant this : "i havent used an AV for about a year".."google.com will tell you if you have anything dodgy on your pc as it wont let you use it !"

[dodger42]

This is only a problem if you have the corporate edition of antivirus. Norton products (which no doubt most of us consumers use) are not affected.

 

http://www.symantec.com/avcenter/security/Content/2006.05.25.html

[Guest IguanaKing]

I agree with Weta, Firefox and Google aren't really good against viruses, and they don't stop a lot of the other nastiness that's out there....especially if you have a broadband connection. If you have broadband, you also need a firewall, a router, or both. And even THEN, you're not 100% safe.

 

If you make sales transactions on the internet, make sure you have instant internet access to ALL of your bank and credit card accounts. Your info is out there, whether you like it or not, and it may end up in the hands of someone other than you. The best way to combat that is to catch fraud early, by using the internet. Its a huge gunfight on the 'net. Its best to go armed with a gun, rather than a knife or nothing at all.

[leafer]

OT

 

Anyone knows of a 'free' program that prevents anyone other than myself from downloading and installing program(s) on my computer? If there is even such a program out there.