SecurityBrief New Zealand - Technology news for CISOs & cybersecurity decision-makers
Story image
Security hole in Symantec antivirus exposes Windows, Linux and Macs
Wed, 18th May 2016
FYI, this story is more than a year old

A major security vulnerability has been uncovered by UK white hat hacker and Google Project Zero developer, Tavis Ormandy. The vulnerability applies to the Symantec Antivirus Engine used in most Symantec and Norton branded Antivirus products and could see Linux, Mac and Windows PCs compromised.

An identical security hole spanning Windows, Linux and Mac operating systems is a very rare thing indeed. Thankfully it is difficult to trigger as it turns out that users need an early version of the Aspack compression tool. Symantec's Antivirus must be installed on the same PC in order to be at risk.

The news isn't that good for those who have both apps installed. It turns out that it's a relatively easy exploit. An emailed file which is scanned by the Symantec Antivirus app will trigger an attack that compromises the operating system.

Sources indicate that Symantec has moved swiftly to remedy this vulnerability. A spokesperson said that Symantec AV users “should already have received an updated version installing updates for this issue.

Symantec recommend that the following practices are followed to minimise the risk of any exposure to this vulnerability:

  • Restrict access to administrative or management systems to authorised privileged users
  • Restrict remote access, if required, to trusted/authorised systems only
  • Run under the principle of least privilege where possible to limit the impact of potential exploit
  • Keep all operating systems and applications up-to-date with vendor patches
  • Follow a multi-layered approach to security. At a minimum, run both firewall and anti-malware applications to provide multiple points of detection and protection to both inbound and outbound threats
  • Deploy network- and host-based intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in the detection of attacks or malicious activity related to the exploitation of latent vulnerabilities.