Symantec Fixes AV Hole

Symantec said today it has fixed a vulnerability in its antivirus software suite that potentially could open a backdoor to hackers.

Left unpatched, the vulnerability, which was first reported late last week by eEye Digital Security, could affect users of Symantec's AntiVirus Corporate Edition 10.0 and Symantec Client Security 3.

"First and foremost, Symantec customers are protected. There is no exploit in the wild of the Symantec vulnerability reported in its corporate antivirus products," Vincent Weafer, senior director of Symantec Security Response, said in an e-mail response to internetnews.com.

According to Weafer, Symantec moved within 24 hours of the first reports of the vulnerability.

"The Symantec teams delivered IPS signatures to protect our customers from any possible exploit attempt -- and in less than three days, Symantec delivered fixes for the vulnerable products," he wrote.

The company said it is not aware of any customers impacted by this vulnerability or any exploits of it.

Symantec described the vulnerability as a "stack overflow in Symantec Client Security and Symantec AntiVirus Corporate Edition could potentially allow a remote or local attacker to execute code on the affected machine."

The stack overflow, according to Symantec, could lead to system crashes or allow hackers to execute arbitrarily malicious code on a system level.

Article courtesy of internetnews.com