Slashdot Mirror
Symantec Confirms AV Library Flaw, Promises Patch
the_flyswatter writes "Anti-virus vendor Symantec Corp. has publicly acknowledged that a high-risk buffer overflow vulnerability in its AntiVirus Library could lead to code execution attacks when RAR archive files are scanned.
The company confirmed the issue was a buffer overflow in the AntiVirus component used to decompose RAR (Roshal Archive) files.
'A specially crafted RAR file could potentially cause this buffer overflow to occur and execute hostile content from the RAR file,' the advisory read. The bug also affects 15 consumer products, including the widely deployed Symantec Norton AntiVirus, Symantec Norton Internet Security Professional, Norton Personal Firewall and Symantec Norton Internet Security for Macintosh."
Installing Symantec on your Mac makes it LESS secure than it was before.
How ironic...
Without a proper flamewar, Anonymous was undecided on what shell to run.
Why did Symantec verify officially that this bug was present before fixing it? Now, evil RAR packages will probably be much more wide-spread than before.
[sig]
The Microsoft solution to the Microsoft solution to the Microsoft solution to the Microsoft solution to the...
The exploit you really have to look out for is the one I send to you get a specific bit of information off your system, which sends the info to a maildrop and then deletes itself without ever calling attention to itself.
The viruses which propogate all over the place and get their footprints into antivirus databases are jokes, really.
http://michaelsmith.id.au
Computer security is not availiable in click-wrapped form, it's about time that companies stopped marketing software as some cure-all for lack of user education.
Our info security dept have advised us NOT to use Symantec AV products on our home PCs because, in their experience, they just don't work very well against a lot of the current crop of malware. You might as well use AVG and save the money. Norton AV also gets deep into a PC and is difficult to uninstall cleanly.
I agree. Your best defence on the Internet is a hardware firewall router and a well-developed bullshit detector. Doesn't slow your computer down.
When I am king, you will be first against the wall.
i'm a netadmin on an irc network and i've seen many zombie botnets, most of them are running "up-to-date" symantec antivirus products and feel safe while behind their backs their systems keep ddosing and hogging bandwith.
symantec doesn't make me feel safe for sure.
http://www.avast.com/ Just one more reason to stick with the free (as in beer) stuff.
If you have windows clients your internet gateway (web proxy, email server) needs to be aware of the sort of content which can impact the clients.
I lost a job supplying a linux router to a company with windows clients because the linux box just couldn't adequately protect the workstations.
Its not fair, but what is?
http://michaelsmith.id.au
Does anyone know if Symantec wrote their own unrar library that is insecure or have they used Roshal's free code which was probably known to be insecure and someone just discoverd they didn't bother to fix it before including in their products?
Are you serious? RAR is a compression file format. There is noting illegal about it. And this could just as well have happened with any file format.
Also, I don't think you will be so happy when you get an infected RAR file in email, and Symantec AV decides it'd better scan the attatchment before you even read the email.
I figured Peter had unfolded his arms, dressed in a dinner jacket, and, gone out to celebrate having become one of the nouveau riche.
My biggest beef is not with the AV makers, but, rather, with the retail sales people who sell AV software and tell unknowledgeable buyers that their system is now protected against all malware, because, superduper AV ware scans everything before you use it and ensures no malware can execute.
I try to explain to people that AV is alot like a flu shot. It's good enough to give you some protection from the bugs we know are out there but is ineffective against the new, bad stuff coming down the pike.
"Academicians are more likely to share each other's toothbrush than each other's nomenclature."
Cohen
Fuck this "buffer overflow" crap. You mean to tell me RAR actually stands for something?
So according to the Symantec advisory the vulnerability is only present in version 10.x of the Corporate Edition. And there I was, thinking it was about time to upgrade from 8.1 that we're running at work ... not anymore!
Return of the virusses that activate when scanned over. Last time this happened was in..what? The eighties? I always wondered how it was possible for code to become active when scanned over, but now that I do, I really have to frown at this.
And the part about "Formatting Windows" only make it sound like you're incompetent.
Give me a break, please. I just swapped over from CP/M.
so the best defence is to hide behind a hardware firewall router then... what's running on that firewall router??? bet you anything it's most likely Linux...
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
A normal software program compiled has strings in it which can be matched when scanned through. It examines what are known as string literals. There are even some programs for certain compilers that exist to recreate source code from compiled programs but that is a tangent. What we're dealing with here are encoded strings. If Norton knows how to match a program exactly based on certain strings it can match in the software, it can detect it in all cases, bot discovered, no more botpack.
Here's what the smart botpack coders are attempting to do and in many cases doing effectively: They understand that Norton can scan their compiled bot, once it knows the strings to look for inside of it, and release in its Liveupdate a way for all people infected to remove it. Given this, they must either constantly compete with Nortons LiveUpdate's or find another method. If they are savvy enough or greedy enough, they'll find a way to have coded a packer which encodes uniquely every time it packs. For more information on packing in relationship to viruses, its in the field of Anti-Virus Heuristics. A very well known packer is UPX which you can search for and find more about. Many modifications of this packer exist. Essentially a bot"packer" is packing their bots uniquely, obscuring the strings from norton with every pack, meaning every bot appears unique and cannot be identified from any other bot. Of course, bots would probably have unique names or be titled something normally running on a machine such as svchost.exe as a process. This is the common trick and until AntiVirus makers can either employ programmers who can outsmart the encoding schemes these packers are using or users smarten up, its a tough situation for all who download anything from an untrusted source (someone besides your grandmother - and even then!).
Oh. So you're to blame for all the spam I get. Thanks, asshole.
Running a virus for 24 hours really sucks anyway. Also, I hope you never run into one that flashes your BIOS.
Random and weird software I've written.