Symantec, Norton AV products are riddled with serious flaws

[frogboy]

Google security researcher Tavis Ormandy has unearthed a slew of critical vulnerabilities, including many remote code execution flaws, in Symantec and Norton enterprise and consumer AV products.

The flaws affect the core engine deployed in the products and are, according to Ormandy, “as bad as it gets.”

“They don’t require any user interaction, they affect the default configuration, and the software runs at the highest privilege levels possible. In certain cases on Windows, vulnerable code is even loaded into the kernel, resulting in remote kernel memory corruption,” he noted.

The latter is possible because Symantec runs executable file unpackers directly in the kernel.

One of the vulnerabilities (CVE-2016-2208), a trivial buffer overflow, can lead to kernel memory corruption on Windows machines, and can be triggered by the victim simply receiving (and not opening) a specially crafted file or link via email.

Full Article. Symantec, Norton AV products are riddled with serious flaws - Help Net Security

 

[bjm_]

Tuesday, June 28, 2016
Thanks to Symantec Security Team for their help resolving these bugs quickly.​

http://googleprojectzero.blogspot.com/2016/06/how-to-compromise-enterprise-endpoint.html (link is external)

 

[spaceoctopus]

When you download antivirus software, you expect it to protect your computer, not threaten it. And yet for all the good that Symantec/Norton's security programs do, it turns out they may be able to do even more harm.
An amazingly disastrous flaw could let cybercriminals attack a Windows machine at the deepest level, regardless of whether you have the home (Norton) or enterprise (Symantec) version of the company's programs — as do tens of millions of computers worldwide. Worse still: Not every system will get the fix automatically...

Symantec/Norton Antivirus Flaw Threatens Millions of PCs

 

[DJ Panda]

I love using Avast Free been very good. I don't hate Norton but $39 for their lowest thing..

 

[XhenEd]

Symantec/Norton users only? It's a small percentage. It's not just millions of PCs. We're talking about hundreds of millions of PCs. Other AVs/AMs are as much vulnerable as Symantec's security products. Heck, every software, security related or not, is vulnerable to attacks!

 

[darko999]

Never liked norton at all, not liked in the past nor in the present.

 

[Ink]

Never liked norton at all, not liked in the past nor in the present.

Ever since they started listening to customer feedback and optimising their code, Norton has been quite a good security product to use.

This past year we have seen many security vendors have flaws in their software.

 

[Alkajak]

This past year we have seen many security vendors have flaws in their software.

/thread

We've seen a massive rise in ransomware, exploits, etc. There is no perfect vendor right now, they all have their flaws. From time to time, those flaws are discovered and reported publicly. Other times, those are flaws are undiscovered and remain unreported.

 

[hjlbx]

The whole point of Google Project Zero is to find vulnerabilities that security soft vendors miss in their own products - either by neglect, oversight (poor review), poor design, etc.

Symantec\Norton is no different than COMODO is no different than Kasperskey is no different than Bromium is no different than...

 

[spaceoctopus]

Norton is a good and decent product. Anyway every security suite or antivirus has bugs and vulnerabilities. Last year i remember Avast, Avg ,Bitdefender had flaws and vulnerabilities in their product.

ESET had a serious one which was discovered by Project zero too:
Project Zero: Analysis and Exploitation of an ESET Vulnerability

Critical flaw in ESET products shows why spy groups are interested in antivirus programs

Best way to keep all this under control is to get informed and make sure that your product is up to date.

 

[Andytay70]

i used Norton on my server a couple of years back, It was very good at fending off nasties.

 

[jamescv7]

Honestly it is a blessing in disguise where Norton could improve more on self-protection of their AV against manipulation.

Lucky for those researcher that can manage to find holes on some major products cause it is a prime advantage for them to fix it.

 

[JB007]

Hi
I'm reading this Flawed code hooking engines open endpoints to compromise - Help Net Security and I don't knoxw if it's the same falw ?