Slashdot Mirror
Symantec Confirms AV Library Flaw, Promises Patch
the_flyswatter writes "Anti-virus vendor Symantec Corp. has publicly acknowledged that a high-risk buffer overflow vulnerability in its AntiVirus Library could lead to code execution attacks when RAR archive files are scanned.
The company confirmed the issue was a buffer overflow in the AntiVirus component used to decompose RAR (Roshal Archive) files.
'A specially crafted RAR file could potentially cause this buffer overflow to occur and execute hostile content from the RAR file,' the advisory read. The bug also affects 15 consumer products, including the widely deployed Symantec Norton AntiVirus, Symantec Norton Internet Security Professional, Norton Personal Firewall and Symantec Norton Internet Security for Macintosh."
Installing Symantec on your Mac makes it LESS secure than it was before.
How ironic...
Without a proper flamewar, Anonymous was undecided on what shell to run.
Why did Symantec verify officially that this bug was present before fixing it? Now, evil RAR packages will probably be much more wide-spread than before.
[sig]
The Microsoft solution to the Microsoft solution to the Microsoft solution to the Microsoft solution to the...
so, no product is secure enough or free from such bugs!
Manojar - pronounced like Manager
Windows AV software is inherently problematic because it has to use undocumented, unarchitected means to gain access to the OS to do it job.
This current vulnerability is only the most obvious type of risk with using AV software. More troublesome, and the reason we don't use AV software, is when the AV software itself breaks, the OS can also be affected. And when the AV software is broken and won't uninstall, the only alternative left is to reformat Windows and start again.
No thanks, AV software!
Computer security is not availiable in click-wrapped form, it's about time that companies stopped marketing software as some cure-all for lack of user education.
Our info security dept have advised us NOT to use Symantec AV products on our home PCs because, in their experience, they just don't work very well against a lot of the current crop of malware. You might as well use AVG and save the money. Norton AV also gets deep into a PC and is difficult to uninstall cleanly.
It's been out in the public scene for about three days now, wich in all likelyhood means that it's been available in closed groups for about two weeks to one month. Especially since it's a handy trojan exploit for zombie worms.
i'm a netadmin on an irc network and i've seen many zombie botnets, most of them are running "up-to-date" symantec antivirus products and feel safe while behind their backs their systems keep ddosing and hogging bandwith.
symantec doesn't make me feel safe for sure.
http://www.avast.com/ Just one more reason to stick with the free (as in beer) stuff.
Any flaw like this is going to catch some people eventually, because they won't have updated their software for whatever reason. So that's bad news. The good news is that at least Symantec have acknowledged the problem and are taking steps to deal with it, rather than trying to hide things.
None of this is going to make me like Symantec and its dog-slow products, but it hardly seems that big a deal. If say an open-source outfit like clamav had announced a bug it would hardly merit headlines. Going with Windows means closed source all the way down the line and that's a case of like it, lump it or jump ship. It would be fairly surprising if there weren't quite a few bugs in all the Windows "security" products - that amounts to a lot of code by now. Still, they are being tackled
Las qué passoun
tournoun pas maï
Does anyone know if Symantec wrote their own unrar library that is insecure or have they used Roshal's free code which was probably known to be insecure and someone just discoverd they didn't bother to fix it before including in their products?
Are you serious? RAR is a compression file format. There is noting illegal about it. And this could just as well have happened with any file format.
Also, I don't think you will be so happy when you get an infected RAR file in email, and Symantec AV decides it'd better scan the attatchment before you even read the email.
What a coincidence? Someone just warned me about opening these files in my mail.
Meanwhile this will do
http://www.enertainmentmagazine.com/
I figured Peter had unfolded his arms, dressed in a dinner jacket, and, gone out to celebrate having become one of the nouveau riche.
My biggest beef is not with the AV makers, but, rather, with the retail sales people who sell AV software and tell unknowledgeable buyers that their system is now protected against all malware, because, superduper AV ware scans everything before you use it and ensures no malware can execute.
I try to explain to people that AV is alot like a flu shot. It's good enough to give you some protection from the bugs we know are out there but is ineffective against the new, bad stuff coming down the pike.
"Academicians are more likely to share each other's toothbrush than each other's nomenclature."
Cohen
Fuck this "buffer overflow" crap. You mean to tell me RAR actually stands for something?
So according to the Symantec advisory the vulnerability is only present in version 10.x of the Corporate Edition. And there I was, thinking it was about time to upgrade from 8.1 that we're running at work ... not anymore!
In this scenario,how reliable is AVG Antivirus from Grisoft? I've heard its good?
Can it be used as a alternative to symantec?
Why does yahoo do this
Solution (FTA) :Wheeler recommends that users disable the scanning of RAR compressed files, including RAR self-extracting files.
Why does yahoo do this
Why does symantec suck so bad these days? I used to use Norton Utilities with MS-DOS, before windows 3.0 came out. I thought NU was great. I've been buying symantec systems works every year, except 2005. It started to suck too much. Now, I don't even use systemworks 2004, I prefer 2003.
I haven't seen squat for innovation in years. It is if they don't put any effort into it. It's just the same old product re-hashed, only it sucks worse.
Maybe symantec is just putting all of their effort into the enterprize sector?
Old News Baby http://www.oldnewsbaby.com/url/ef3a3f1c625f96914d0 42a876e3e85eb
Return of the virusses that activate when scanned over. Last time this happened was in..what? The eighties? I always wondered how it was possible for code to become active when scanned over, but now that I do, I really have to frown at this.
YHBT. YHL. HAND.
A normal software program compiled has strings in it which can be matched when scanned through. It examines what are known as string literals. There are even some programs for certain compilers that exist to recreate source code from compiled programs but that is a tangent. What we're dealing with here are encoded strings. If Norton knows how to match a program exactly based on certain strings it can match in the software, it can detect it in all cases, bot discovered, no more botpack.
Here's what the smart botpack coders are attempting to do and in many cases doing effectively: They understand that Norton can scan their compiled bot, once it knows the strings to look for inside of it, and release in its Liveupdate a way for all people infected to remove it. Given this, they must either constantly compete with Nortons LiveUpdate's or find another method. If they are savvy enough or greedy enough, they'll find a way to have coded a packer which encodes uniquely every time it packs. For more information on packing in relationship to viruses, its in the field of Anti-Virus Heuristics. A very well known packer is UPX which you can search for and find more about. Many modifications of this packer exist. Essentially a bot"packer" is packing their bots uniquely, obscuring the strings from norton with every pack, meaning every bot appears unique and cannot be identified from any other bot. Of course, bots would probably have unique names or be titled something normally running on a machine such as svchost.exe as a process. This is the common trick and until AntiVirus makers can either employ programmers who can outsmart the encoding schemes these packers are using or users smarten up, its a tough situation for all who download anything from an untrusted source (someone besides your grandmother - and even then!).
No, you have lost, you're just giving me time to kill =).
So you're telling me, that my ENTIRE college, with the world's stupidest tech department, is forced to rely on symantec corporate edition..... All because it's supposed to STOP the viruses. Will someone PLEASE tell me how this is helping now?
If I was to invent a new virus scanner right now, I would make sure all my decompression and scanning code runs in some managed environment, like a
Christian
--- Eat my sig.
i've occasionally been sent legitimate files by friends as rars but the truth is the main place where rar is seen is indeed warez.
who would wan't to release legitimate software in a form that can only be read by a single companies nagware tool when there are free alternatives arround that often give better compression? (pirates don't care because they can just crack winrar itself).
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
We don't have any virus protection on our windows boxes at the school I work at. We run Deep Freeze on all of them. No matter what happens to the computer during the day, rebooting will erase any changes made, and restore the PC to the desired state. No viruses. No spyware. No accidental system file deletions or corruptions. Sweet.
It has it's downsides, but mostly just inconveniences.
Any opinions on taking such an approach rather than using AV software?
"Only currently supported Symantec Products will be updated. Customers using unsupported versions are encouraged to upgrade to a supported version."
In the end, this could turn into a win for them. Everyone lagging behind on affected products will have to shell out for the upgrade.
I bet we won't see any of those "free after rebate" deals for a while...
-bitrot-
FIXME: Add a sig here
Doesn't yahoo, or msn use Norton AV as its scanning engine? I imagine the same flaw exists unless the enterprise av engine is vastly different from the person av engine.
Nothing costs nothing
http://housecall.trendmicro.com/ allready done, java virus scanner, cross platform, removes as well as finds. Now if only it worked as resident protection... ahh well, now that would be wanting everything :)
...
There are a number of packages that can utilize .rar files. I am partial to ZipGenius:
http://www.zipgenius.it/index_eng.htm
Free (like drinking your friend's beer) and supports every compression type I have ever seen on a Windows platform. And no nagging or guilt!
And as you tread the halls of sanity, You feel so glad to be, Unable to go beyond. I have a message, From another time..
I'll be the first to agree that most anti-virus software is a ripoff. But I've been steering folks clear of Symantec AV products for years now. Their stuff is bloated, buggy, and inefficient at doing the job - and insistence on going through "product activation" for retail and OEM products just make it that much less appealing.
That said, your statement that AV software is purely "snake oil"? I have to take exception to that one. I think it's arguable that *some* people wouldn't get enough value from AV software to make it worth using, but not usually.
First of all, if you're a Mac user, then no - please don't waste time with AV products like Virex or Symantec! Right now, they only find a few really dumb attempts at "trojan horse" viruses for OS X that are about as threatening as someone writing a DOS batch file containing "FORMAT C:" and emailing it to people, saying "double click this cool new program!" Their *real* reason for existance is SUPPOSED to be cleaning up viruses in email so you don't accidently become guilty of redistributing some virus you received on your Mac and infecting a Windows user on the other end. But the problems and performance hits these products give most Macs make them unacceptable.
Secondly, if you're a Windows user who doesn't have his/her PC connected to the net at all and generally just keep using the same software on it all the time (or only upgrade from purchased CD-ROM/DVD-ROM discs), you probably can skip the anti-virus software. (I mean, are you THAT concerned about people sticking infected floppy disks in your machine and screwing stuff up? If so, get the AV software - but otherwise, how is your machine ever going to become infected in the first place?)
But TYPICALLY, you use Anti-Virus software on a clean PC to try to KEEP it that way. Yeah, if you get spyware in, it's going to install 10-15 other pieces of malware and "helper viruses" that make it difficult to clean'remove. But an up-to-date realtime scanner should prevent a virus from running in the first place, assuming it came in via email or piggybacked onto some file you downloaded and tried to use. Spyware only messes things up if you allow it to install - so at least in theory, you should be able to keep it from being an issue by not installing software of unknown origin. The virus scanner is supposed to prevent the OTHER type of problem; infection by opening what was supposed to be a perfectly legitimate document or piece of software, except it had something bad secretly attached to it.
I can't tell the two apart anymore, both MS and Symantec are behemouths that appear to cause many more problems for users than they actually appear to solve.
What would Groucho do?
I don't have the bulletin at home and I'm not at work or I'd post a link but this isn't as bad as it sounds. The virus definitions as of 12/20 detect the malformed RAR files as a heuristics detection so as long as your definitions are 12/20 or newer, you should be mostly safe.
You know? Like
Arrrr!! Rarrr!
Buffer overflows and other security issues are a dime a dozen. Just subscribe to Secunia's RSS feed to see that.
Ha ha ha ha ha ha ha.
Disclaimer: I work for McAfee.
This exact scenario was described in a pretty funny scene in the SF novel Jennifer Government. Hacker chick: "You put a lot of faith in your virus scanner...for a product with buffer overflow issues..."
Every time I get to fix a machine, it is one that other people tried and couldn't fix. In all cases, the machine is running up to date Norton or Mcaffee scanners.
Consequently, the first thing i do, is uninstall all anti-virus crap, then reboot into safe mode and install my trusted utilities: Anti-Vir, Spybot S&D, Adaware and Hijackthis from a CDROM containing the latest updates.
Lately however, I have run into the Smitfraud-C piece of work. This thing requires a dedicated remover called Smitrem, otherwise it just keeps coming back a few minutes after removing it. This is an incredibly crafty piece of junk which seems to be made by the New Zealand company Spyaxe.
Oh, well, what the hell...
Oh well, what the hell...
and whilst there is official unrar source (under a nasty don't compete with our compressor type license) availible last i checked it was not up to date with current versions of the rar format.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Further Proof to management that keeping attachments @ 5mb was a great idea.
(see above)
Symantec uses the same AV software in their "Brightmail" product
in use at ISPs such as Hotmail and Earthlink. Presumably, the correct
email message could bring down MSN.
Wow, that took me back a bit in time. I sure do remember McAfee missing half the infections of a particular TravellerJack virus. But also how almost none of the big vendors knew how to remove the Form-virus from my bootsector. None, except...MSAV. Aka Microsoft Anti-Virus, which was huuuuugely outdated on my DOS 6.2 install.