UPDATED: Just in time for the holidays, Symantec’s antivirus programs have been
found to have a “highly critical” vulnerability for which there is currently
The Symantec AntiVirus RAR Archive Decompression Buffer Overflow vulnerability could allow an attacker to gain control of a system. The
vulnerability affects at least 39 different Symantec antivirus products,
according to an advisory from security firm Secunia.
Secunia credits security researcher Alex Wheeler for discovering
the flaw, which allegedly exists within the Symantec Antivirus
library and could potentially allow for multiple heap
overflows when Symantec’s products scan a malicious RAR archive.
A RAR archive is a compressed archive file (similar to a Zip file).
According to Wheeler’s advisory, “These vulnerabilities can
be exploited remotely without user interaction in default configurations
through common protocols such as SMTP.”
Users of Symantec’s antivirus products are warned to disable scanning of
RAR compressed files until such time as the vulnerable code has been
Symantec is now claiming that its security response team has in fact posted an AntiVirus based protection signature to LiveUpdate providing a heuristic detection for potential exploits of the Symantec decomposer RAR archive vulnerability.
According to Symantec, the update signature is available to all desktop, server and gateway product versions of Symantec’s security products and appliance solutions that contain the decomposer RAR archive.
Symantec strongly recommends that customers immediately ensure their virus definitions are up to date to protect against any possible threat. To date, the company has not had any reports of related exploits of this issue.
Yet despite Symantec’s statement, as of 3:30 p.m. EST, the company had not yet issued an advisory about the issue on its publicly available security response Web site.
According to a Symantec statement received by internetnews.com, “Information about specific product updates and mitigation will be posted to Symantec Security Response Web site later today.”