Symantec said today it has fixed a vulnerability in its antivirus software
suite that potentially could open a backdoor to hackers.
Left unpatched, the vulnerability, which was first reported late last week by eEye Digital Security, could affect users of Symantec’s
AntiVirus Corporate Edition 10.0 and Symantec Client Security 3.
“First and foremost, Symantec customers are protected. There is no exploit
in the wild of the Symantec vulnerability reported in its corporate
antivirus products,” Vincent Weafer, senior director of Symantec Security
Response, said in an e-mail response to internetnews.com.
According to Weafer, Symantec moved within 24 hours of the first reports of
the vulnerability.
“The Symantec teams delivered IPS signatures to protect our customers from
any possible exploit attempt — and in less than three days, Symantec
delivered fixes for the vulnerable products,” he wrote.
The company said it is not aware of any customers impacted by this vulnerability or any exploits of it.
Symantec described the vulnerability as a “stack overflow in Symantec Client
Security and Symantec AntiVirus Corporate Edition could potentially allow a
remote or local attacker to execute code on the affected machine.”
The stack overflow, according to Symantec, could lead to system crashes or
allow hackers to execute arbitrarily malicious code on a system level.