Symantec Fixes AV Hole

The hole that wasn't gets a patch.

 By Roy Mark | Posted May 30, 2006
Page of   |  Back to Page 1
Print ArticleEmail Article
  • Share on Facebook
  • Share on Twitter
  • Share on LinkedIn


Learn How a Virtual Networking Approach Can Strengthen the Security of Federal Networks

Symantec said today it has fixed a vulnerability in its antivirus software suite that potentially could open a backdoor to hackers.

Left unpatched, the vulnerability, which was first reported late last week by eEye Digital Security, could affect users of Symantec's AntiVirus Corporate Edition 10.0 and Symantec Client Security 3.

"First and foremost, Symantec customers are protected. There is no exploit in the wild of the Symantec vulnerability reported in its corporate antivirus products," Vincent Weafer, senior director of Symantec Security Response, said in an e-mail response to

According to Weafer, Symantec moved within 24 hours of the first reports of the vulnerability.

"The Symantec teams delivered IPS signatures to protect our customers from any possible exploit attempt -- and in less than three days, Symantec delivered fixes for the vulnerable products," he wrote.

The company said it is not aware of any customers impacted by this vulnerability or any exploits of it.

Symantec described the vulnerability as a "stack overflow in Symantec Client Security and Symantec AntiVirus Corporate Edition could potentially allow a remote or local attacker to execute code on the affected machine."

The stack overflow, according to Symantec, could lead to system crashes or allow hackers to execute arbitrarily malicious code on a system level.

Article courtesy of

Comment and Contribute
(Maximum characters: 1200). You have
characters left.
Get the Latest Scoop with Enterprise Networking Planet Newsletter