Security hole in Symantec antivirus exposes Windows, Linux and Macs

Wed, 18th May 2016

FYI, this story is more than a year old

By Patrick Pilcher, Ex editor/contributor

A major security vulnerability has been uncovered by UK white hat hacker and Google Project Zero developer, Tavis Ormandy. The vulnerability applies to the Symantec Antivirus Engine used in most Symantec and Norton branded Antivirus products and could see Linux, Mac and Windows PCs compromised.

An identical security hole spanning Windows, Linux and Mac operating systems is a very rare thing indeed. Thankfully it is difficult to trigger as it turns out that users need an early version of the Aspack compression tool. Symantec's Antivirus must be installed on the same PC in order to be at risk.

The news isn't that good for those who have both apps installed. It turns out that it's a relatively easy exploit. An emailed file which is scanned by the Symantec Antivirus app will trigger an attack that compromises the operating system.

Sources indicate that Symantec has moved swiftly to remedy this vulnerability. A spokesperson said that Symantec AV users "should already have received an updated version installing updates for this issue.

Symantec recommend that the following practices are followed to minimise the risk of any exposure to this vulnerability:

Restrict access to administrative or management systems to authorised privileged users

Restrict remote access, if required, to trusted/authorised systems only

Run under the principle of least privilege where possible to limit the impact of potential exploit

Keep all operating systems and applications up-to-date with vendor patches

Follow a multi-layered approach to security. At a minimum, run both firewall and anti-malware applications to provide multiple points of detection and protection to both inbound and outbound threats

Deploy network- and host-based intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in the detection of attacks or malicious activity related to the exploitation of latent vulnerabilities.

Share on: