Slashdot Mirror
Symantec Confirms AV Library Flaw, Promises Patch
the_flyswatter writes "Anti-virus vendor Symantec Corp. has publicly acknowledged that a high-risk buffer overflow vulnerability in its AntiVirus Library could lead to code execution attacks when RAR archive files are scanned.
The company confirmed the issue was a buffer overflow in the AntiVirus component used to decompose RAR (Roshal Archive) files.
'A specially crafted RAR file could potentially cause this buffer overflow to occur and execute hostile content from the RAR file,' the advisory read. The bug also affects 15 consumer products, including the widely deployed Symantec Norton AntiVirus, Symantec Norton Internet Security Professional, Norton Personal Firewall and Symantec Norton Internet Security for Macintosh."
The Microsoft solution to the Microsoft solution to the Microsoft solution to the Microsoft solution to the...
The exploit you really have to look out for is the one I send to you get a specific bit of information off your system, which sends the info to a maildrop and then deletes itself without ever calling attention to itself.
The viruses which propogate all over the place and get their footprints into antivirus databases are jokes, really.
http://michaelsmith.id.au
Computer security is not availiable in click-wrapped form, it's about time that companies stopped marketing software as some cure-all for lack of user education.
I agree. Your best defence on the Internet is a hardware firewall router and a well-developed bullshit detector. Doesn't slow your computer down.
When I am king, you will be first against the wall.
I figured Peter had unfolded his arms, dressed in a dinner jacket, and, gone out to celebrate having become one of the nouveau riche.
My biggest beef is not with the AV makers, but, rather, with the retail sales people who sell AV software and tell unknowledgeable buyers that their system is now protected against all malware, because, superduper AV ware scans everything before you use it and ensures no malware can execute.
I try to explain to people that AV is alot like a flu shot. It's good enough to give you some protection from the bugs we know are out there but is ineffective against the new, bad stuff coming down the pike.
"Academicians are more likely to share each other's toothbrush than each other's nomenclature."
Cohen
So according to the Symantec advisory the vulnerability is only present in version 10.x of the Corporate Edition. And there I was, thinking it was about time to upgrade from 8.1 that we're running at work ... not anymore!
Too bad clamwin is a peice of shit
ive seen the task tray icon application, while doing nothing else but showing a small clamwin icon in the corner, use ~500MB of memory in just 1 day (only saw this once, usually it only goes to 50-150mb, which is still insane for just a damn icon, nevermind the scanner which uses a ton itself and takes like 4 days to scan 80 gigs)
And the 14 year old speaks! Wow, I was just waiting for that. So, tell me, when was the last time you designed and built an operating system?
What if we encrypted our virus with a random encryption, and only the decrypter could be scanned for? Well, if we did that, we'd be doing what viruswriters were doing late eighties/early nineties. What ever came of it? Anti-virus writers outsmarted the viruswriters, by actually scanning for the decoding pieces or patterns in the code that indicated certain types of encryption.
Now we're slightly further down the road, and we moved from encrypted to oligomorphic (weak polymorphism) to polymorhpic to metamorphic code. Metamorphic code is code that completely changes from generation to generation (read up on the MetaPHOR virus and metamorphism for more details). And yet..anti-virus writers still manage to detect these (with great difficulty however), and have been for quite a while. Metamorphic viruses are incredibly complex however, so you won't see them in the wild often because they're hard to create, and there's hardly any niche for viruses any more. Either your malware is a worm that understands open ports and/or mailing itself to others, or it's a internet-unaware virus that remains stuck on the hard disk.
Grand-grand-parent's post thus adds little to the discussion. What he speaks of is 1.5 decennia old, and has NOTHING to do with the current article: a well-known anti-virus vendor allowing malicious code-execution through a buffer-overflow. Mods: please mod his pointlessly bolded post 'overrated'. A '5' is dissapointingly high for this geek crowd.
Ah yes, the "I've been using computers for 100 years so I know all about computers TODAY" argument. When I did tech support people like you were the absolute worst customers because they think they know everything and actually know jack shit about modern operating systems.
Why would you think that using punch cards and a soldering iron gives you any insight at all into how Windows works? Great leaps of logic there old timer, you might want to look into getting checked for Alzheimers.