Symantec Bug Not Likely To Be Hit By Worm, Says Rival

Iria · Dec 26, 2005, 12:30 AM

The vulnerability in Symantec's anti-virus line disclosed earlier this week isn't a big risk, a rival security firm said Friday.

Internet Security Systems' X-force research group said in an online alert that although the vulnerability is serious, the "likelihood of this vulnerability being leveraged by a worm is low."

The bug in Symantec's AntiVirus Library, a component shared among more than 60 titles in the Cupertino, Calif.-based company's security line-up, was made public earlier this week. The Library can be compromised by sending a malicious RAR archive file as an e-mail attachment, which then creates a heap overflow on the victimized PC or Mac. That condition could allow the attacker to introduce his own code remotely, without any user interaction.

Internet Security System (ISS), however, noted that a successful exploitation of the flaw requires a very large RAR file, one in the 35-40MB range.

"Files this large are not generally passed by mail servers and [so we] can eliminate this as a vector for a worm," continued the ISS alert.

Symantec has pushed out an update that should spot any attempt to exploit the bug, but it has not yet produced patches to fix the underlying flaw.
___________
Source: Information Week

Dec 26, 2005, 12:30 AM	#1
Iria DriverHeaven Extreme Member Join Date: Apr 2004 Posts: 7,275 Rep Power: 89	Symantec Bug Not Likely To Be Hit By Worm, Says Rival The vulnerability in Symantec's anti-virus line disclosed earlier this week isn't a big risk, a rival security firm said Friday. Internet Security Systems' X-force research group said in an online alert that although the vulnerability is serious, the "likelihood of this vulnerability being leveraged by a worm is low." The bug in Symantec's AntiVirus Library, a component shared among more than 60 titles in the Cupertino, Calif.-based company's security line-up, was made public earlier this week. The Library can be compromised by sending a malicious RAR archive file as an e-mail attachment, which then creates a heap overflow on the victimized PC or Mac. That condition could allow the attacker to introduce his own code remotely, without any user interaction. Internet Security System (ISS), however, noted that a successful exploitation of the flaw requires a very large RAR file, one in the 35-40MB range. "Files this large are not generally passed by mail servers and [so we] can eliminate this as a vector for a worm," continued the ISS alert. Symantec has pushed out an update that should spot any attempt to exploit the bug, but it has not yet produced patches to fix the underlying flaw. ___________ Source: Information Week Last edited by Iria; Dec 26, 2005 at 12:40 AM.