Story image

Security hole in Symantec antivirus exposes Windows, Linux and Macs

18 May 16

A major security vulnerability has been uncovered by UK white hat hacker and Google Project Zero developer, Tavis Ormandy. The vulnerability applies to the Symantec Antivirus Engine used in most Symantec and Norton branded Antivirus products and could see Linux, Mac and Windows PCs compromised.

An identical security hole spanning Windows, Linux and Mac operating systems is a very rare thing indeed. Thankfully it is difficult to trigger as it turns out that users need an early version of the Aspack compression tool. Symantec’s Antivirus must be installed on the same PC in order to be at risk.

The news isn't that good for those who have both apps installed. It turns out that it's a relatively easy exploit. An emailed file which is scanned by the Symantec Antivirus app will trigger an attack that compromises the operating system.

Sources indicate that Symantec has moved swiftly to remedy this vulnerability. A spokesperson said that Symantec AV users “should already have received an updated version installing updates for this issue.”

Symantec recommend that the following practices are followed to minimise the risk of any exposure to this vulnerability:

  • Restrict access to administrative or management systems to authorised privileged users
  • Restrict remote access, if required, to trusted/authorised systems only
  • Run under the principle of least privilege where possible to limit the impact of potential exploit
  • Keep all operating systems and applications up-to-date with vendor patches
  • Follow a multi-layered approach to security. At a minimum, run both firewall and anti-malware applications to provide multiple points of detection and protection to both inbound and outbound threats
  • Deploy network- and host-based intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in the detection of attacks or malicious activity related to the exploitation of latent vulnerabilities.
SonicWall secures hybrid clouds by simplifying firewall deployment
Once new products are brought online in remote locations, administrators can manage local and distributed networks.
What MSPs can learn from Datto’s Channel Ransomware Report
While there have been less high profile attacks making the headlines, the frequency of attacks is, in fact, increasing.
Cisco expands security capabilities of SD­-WAN portfolio
Until now, SD-­WAN solutions have forced IT to choose between application experience or security.
AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
Kiwis losing $24.7mil to scam calls every year
The losses are almost five times higher compared to the same period last year, from reported losses alone.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why Australian enterprises are prime targets for malware attacks
"Only 14% of Australian organisations are continuously training employees to spot cyber attacks."
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”