This week a report was released that Symantec Antivirus Corporate Edition
10.x (PC), Symantec Norton Antivirus 9.x (Mac), and Symantec Norton
Antivirus for Exchange 2.x products are vulnerable to a library heap
overflow if Symantec AV scans .RAR* files while they are being
decompressed, resulting in the potential for the Symantec Antivirus
product to be exploited by a malicious hacker who can take control of the
affected computer.
Symantec has not released a patch for this vulnerability. In the meantime
I have changed the central Symantec servers to scan certain file types
rather than all file types in auto-protect mode. The list of currently
auto-protected file types is the default list that Symantec provides, as
well as .ZIP files. As would be assumed, .RAR files are not being scanned
via auto-protect at this time. Please note that this change only affects
auto-protect scanning on PCs. Macintosh Symantec/Norton Antivirus and
Symantec Norton Antivirus for Exchange are -not- protected by the central
servers, so Macintosh users and Exchange server administrators must either
choose to disable auto-protect via the Norton Antivirus options or choose
not to download and decompress .RAR files while the vulnerability still
exists.
More information about the vulnerability is available at:
- http://news.zdnet.co.uk/internet/security/0,39020375,39243160,00.htm
- http://xforce.iss.net/xforce/alerts/id/187