A major security vulnerability has been uncovered by UK white hat hacker and Google Project Zero developer, Tavis Ormandy. The vulnerability applies to the Symantec Antivirus Engine used in most Symantec and Norton branded Antivirus products and could see Linux, Mac and Windows PCs compromised.
An identical security hole spanning Windows, Linux and Mac operating systems is a very rare thing indeed. Thankfully it is difficult to trigger as it turns out that users need an early version of the Aspack compression tool. Symantec’s Antivirus must be installed on the same PC in order to be at risk.
The news isn't that good for those who have both apps installed. It turns out that it's a relatively easy exploit. An emailed file which is scanned by the Symantec Antivirus app will trigger an attack that compromises the operating system.
Sources indicate that Symantec has moved swiftly to remedy this vulnerability. A spokesperson said that Symantec AV users “should already have received an updated version installing updates for this issue.”
Symantec recommend that the following practices are followed to minimise the risk of any exposure to this vulnerability: