A critical software bug has been discovered in several of the most widely used anti-virus programs. It could be exploited to take control of a computer or to steal information, according to an analysis produced by the independent security analyst who made the discovery.
The glitch affects 39 different Symantec products 鈥� including both home and enterprise versions of its anti-virus software. It resides within the Symantec anti-virus library, which is used by all of the packages.
The analyst, Alex Wheeler, discovered that a critical error occurs when the Symantec anti-virus library decompresses files from 鈥淩AR鈥� format for analysis. An attacker could exploit the loophole to load unauthorised code onto a computer, and potentially to crack open its defences, he says.
Advertisement
鈥淒uring decompression of RAR files Symantec is vulnerable to multiple heap overflows allowing attackers complete control of the system(s) being protected,鈥� Wheeler writes in his analysis of the flaw. 鈥淭hese vulnerabilities can be exploited remotely without user interaction in default configurations through common protocols.鈥�
Symantec has confirmed the problem and produced an advisory of its own. It is currently working on a permanent fix but has released an update so that computers running its anti-virus software should automatically detect and block attempts to exploit the bug.
So far, there is no evidence that the bug has been used to attack computers. However, a study released in November 2005 by the SANS Institute, a US-based computer security organisation, suggests that computer criminals are increasingly focusing on anti-virus software in order to compromise machines.
This is partly because the software is widely used and runs constantly, but also because bugs in the most widely used operating system 鈥� Microsoft鈥檚 Windows 鈥� are now repaired fairly rapidly.
