Menu
A critical flaw in Symantec antivirus engine puts computers at risk of easy hacking

A critical flaw in Symantec antivirus engine puts computers at risk of easy hacking

The flaw could be exploited by simply sending a malicious email or tricking users to visit a link

The antivirus engine used in multiple Symantec products has an easy-to-exploit vulnerability that could allow hackers to easily compromise computers.

The flaw was fixed by Symantec in Anti-Virus Engine (AVE) version 20151.1.1.4, released Monday via LiveUpdate. The flaw consists of a buffer overflow condition that could be triggered when parsing executable files with malformed headers.

According to Google security engineer Tavis Ormandy, who found the flaw, the vulnerability can be exploited remotely to execute malicious code on computers. All it takes is for the attacker to send an email with the exploit file as attachment or to convince the user to visit a malicious link.

Executing the file is not necessary, because the antivirus engine uses a driver to intercept all system input and output operations and will automatically scan the file as soon as it reaches the file system in any way.

The file extension doesn't matter, as long as the file has a header identifying it as a portable executable file packed with ASPack, a commercial compressor utility.

The worst part about it is that the Symantec AVE unpacks such files inside the kernel, the highest privileged region of the OS. This means that successful exploitation can lead to a full system compromise.

"On Linux, Mac and other UNIX platforms, this results in a remote heap overflow as root in the Symantec or Norton process," Ormandy said in an advisory. "On Windows, this results in kernel memory corruption, as the scan engine is loaded into the kernel, making this a remote ring0 memory corruption vulnerability -- this is about as bad as it can possibly get."

Symantec has rated the vulnerability with a 9.1 severity score out of 10 in the Common Vulnerability Scoring System (CVSS).

"The most common symptom of a successful attack would result in an immediate system crash, aka. Blue Screen of Death (BSOD)," the company said in its own advisory.

Users should make sure that they install the latest available updates available for their Symantec antivirus products and can check the version of the AVE using instructions on Symantec's support website.

This is the latest in a long string of critical vulnerabilities found by Ormandy and other security researchers in antivirus products in recent years. Most of them have criticized antivirus vendors for continuing to perform dangerous file scanning operations, which historically have resulted in vulnerabilities, using kernel privileges.

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags securityantivirus

Featured

Slideshows

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

Revealed at a glitzy bash in Sydney at the Ivy Penthouse, the first StorageCraft Partner Awards locally saw the vendor honour its top-performing partners with ASI Solutions, SMBiT Pro, Webroot, ACA Pacific and Soft Solutions New Zealand taking home the top awards. Photos by Maria Stefina.

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards
Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

​Synnex and Lenovo hosted 18 resellers for an action-packed weekend adventure in RotoVegas, taking in white water rafting on the Kaituna River, as well as quad biking and dinner at Stratosfare​, overlooking Lake Rotorua at the top of Mount Ngongotaha​. Photos by Synnex.

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip
Show Comments