MAJOR Symantec Anti-Virus Vulnerability!

[Angry Girl]

Symantec security products hit by high-risk flaw

Symantec's antivirus software contains a vulnerability that could be exploited by a malicious hacker to take control of a system, the company admitted late on Tuesday.

According to an advisory issued by Secunia, the bug affects most of Symantec's products, including enterprise and home user versions of Symantec AntiVirus, Symantec Norton AntiVirus and Symantec Norton Internet Security, across both the Windows and Macintosh platforms.

The vulnerability is within Symantec AntiVirus Library, which provides file format support for virus analysis. "During decompression of RAR files, Symantec is vulnerable to multiple heap overflows allowing attackers complete control of the system(s) being protected," said security consultant Alex Wheeler, who first discovered the flaw. "These vulnerabilities can be exploited remotely, without user interaction, in default configurations through common protocols such as SMTP."

<SNIP>

Symantec has not yet released a patch to address this problem. In the meantime, Wheeler recommends that users "disable scanning of RAR compressed files until the vulnerable code is fixed".

http://news.zdnet.co.uk/internet/security/0,39020375,39243160,00.htm

You can stop all incoming RAR attachments at your firewall or POP3 server.
A little info here http://www.node707.com/archives/006405.shtml

[Lindacooks]

1. Okay, how do you do that?

Is there a box to check in options in email? Or uncheck?

Please help - thanks.

[Angry Girl]

2. This may help

Your firewalls are all goingto be different. But you can disable incoming email scanning in Symantec and then, if you download anything, well, if it's a RAR file, kill it to be safe (don't run it!). Anything other type of file you download, i.e., NOT an RAR file, you can then run through Symantec to check for viruses.

But get another virus scanner too.

Free AVG for home use from Grisoft highly recommended.
http://www.grisoft.com/doc/289/lng/us/tpl/tpl01

Other free security stuff available here:
http://www.tusafe.com/nonags/security.html

[minkyboodle]

5. AVG rocks

I made the switch from norton mcafee a couple years and and I never looked back. great program

[BenDavid]

3. Anti-virus program

Please, if you decide for the time being to install another anti-virus program please do not have both running at the same time. You can have many anti spyware programs but only 1 anti-virus and 1 firewall running...

[Tandalayo_Scheisskopf]

4. Ok, what I want to know is...

Why the hell there is a Symantec virus schmegeggey for MacOS, when the damn thing is based upon FreeBSD and is just about completely unable to get a virus?

Sounds like Symantec is taking people to the cleaners.

[Angry Girl]

7. Not *unable to get virus*, just not as targeted. Stay protected! nt

[Tandalayo_Scheisskopf]

19. Ok.

Name one FreeBSD virus that has been found in the wild. Just one.

Ain't none.

[arikara]

6. I learned about Norton the hard way

I had Norton antivirus and firewall. My old copy expired and I bought a new one. The stupidity of their system is such that they make you uninstall the old copy before you can install the new one. When I uninstalled the old one it set off 2 trojan horses that it had let into my system in the first place. I was lucky that I had a different modem than I have now, that it was up on the desk and that I saw the lights go wild and was able to cut it off before any damage was done. I contacted Norton, dealt with some questionable characters in India that provided a non-existant sort of support and wound up having to take it to a tech to get it cleaned out. I consequently uninstalled all Norton products and my computer is working way faster and better than ever. I got my money refunded from Norton finally too.

I'm now using AVG free edition and using a router for a firewall.

[Voltaire99]

8. If you must use Windows...

...then you know it has to wear the equivalent of an entire box's worth of condoms. At least you don't have to let the Windows security mafia shake you down constantly.

Get the free AVG here: www.grisoft.com
Get the free Kerio Personal Firewall here: www.kerio.com

Or, get a Mac. :-)

[Tandalayo_Scheisskopf]

20. I might add...

Avast! is a damned good free virus program too. Runs on Windows XP x64, too, which AVG does not.

[yurbud]

9. Best protection: Buy a MAC.

Only viruses I've gotten are PC ones which can't do anything to Mac.

I have to use PCs at work but have never seen anything about it that makes it better than Mac apart from having more games (and viruses) written for it.

[bananas]

10. an earlier post: "From January 2005..."

someone posted to an earlier thread,
this bug has been there for at least a year.
http://www.democraticunderground.com/discuss/duboard.php?az=show_mesg&forum=104&topic_id=5658730&mesg_id=5658969

[onehandle]

11. What's a virus?

I gotta Mac.

[Caution]

12. Macs being safer is a myth

I'm writing this on a Mac, love Macs and owned the ORIGINAL mac, so I'm not here to start some stupid my OS is better than yours flamewar.

Experts explode 'Mac is safer' myth

Mac users are no safer from the threat of viruses than Windows users, according to experts who have just shattered a long standing myth.

Antivirus firm Symantec said that over three quarters of Mac users are under the illusion that they are not a target for virus writers and hackers. It is a misconception commonly shared by users of the Linux operating system.

In fact, 62 per cent of Mac users said that increased security was the main reason for them moving to the platform, according to Symantec.

In the past even the US Army has moved its web servers over to MacOS in the mistaken belief that they will be more secure.

More here:
http://www.computing.co.uk/vnunet/news/2118858/experts-explode-mac-safer-myth

[AndyTiedye]

13. Did Symantec Have to Pay them to Run That Article?

Maybe Microsoft chipped in too.

Has anybody even heard of somebody's Mac being laid low by a virus?

[Ezlivin]

14. No kidding. I've owned Macs since 1985 and have NEVER had a virus

I don't even have virus software on my computer.

It's simple: Out of the box, Windows computers have ALL their ports open. Out of the box a Mac has none open; you have to open them yourself.

And the Mac never integrated the browser with the OS. A big mistake on MS's part, as far as I'm concerned.

[mikeytherat]

16. Virus Barrier X on my Mac, PC-Cillan on my Windoze machines

No viruses, no problems.

mikey_the_rat

[deadmessengers]

18. Viruses have nothing whatsoever to do with ports.

You're confusing viruses with network worms. There's a big difference - a network worm can infect a vulnerable machine and repropagate without any user intervention whatsoever, whereas a virus (aka a Trojan Horse) cannot.

[Tandalayo_Scheisskopf]

21. Viruses need root access to work.

Macs, being based upon FreeBSD, have a security model that does not allow root access without a password and all password information is stored in root. Ergo, they just cannot run.

FreeBSD is a Unix variant. Name a Unix virus. Or a Linux virus. Just one. That is in the wild and presents a threat right now.

[deadmessengers]

22. There aren't any.

There aren't any, nor did I imply there were. I was simply pointing out the error of saying "PCs have all their ports open" when that is not only untrue, but also irrelevant to the reason why PCs get viruses.

Also, viruses do not necessarily need root access to work. The many Outlook mass-mailer viruses over the years would work just fine without root privilege.

One more thing that's worth pointing out - just because there aren't any viruses on the Unix/Linux platforms doesn't make them "secure". There is a whole spectrum of security threats out there, viruses being a small but significant part of those. For example, there have been dozens of remotely-exploitable privilege-escalation vulnerabilities on the Unix and Linux platforms, which are even worse, because the administrators of those machines aren't likely to become immediately aware that they've been exploited.

In general - If you think you're secure, you're wrong, and dangerously so. If you KNOW you're not secure, you're more likely to be on your toes, and you're better off than the person who believes that nothing can hurt them.

[arikara]

15. Never... sounds like a case of misinformation

my next computer is going to be a mac laptop. My daughter and her friends are using them now. They never have the problems that we have.

[Straight Shooter]

17. Does anyone know how this affects Direcway satellite users?

I got some really confusing info about not using a firewall from the Direcway tech who set up my system. He assured me that Direcway has its own type of firewall, which sounded hinky to me but I never open weird attachments and use AV software. Unfortunately, my AV software is on the "hit list."

From reading this info -- thanks, Angry Girl!! -- it's clear that one does not even have to open the attachment, so I'll start using Webmail access until it's considered safe to use my Eudora email client.

But can someone help me and tell me how to filter RAR files at the Direcway firewall in my system, if there is even actually one within my system itself. I can't call Direcway tech; they are the most ignorant clueless techs on the planet. They will probably make it worse, believe me, it's happened before.

(BTW, I'm trying very hard to get wifi locally, it's just so remote here and I'm on a long list for the local ISP to visit and see if I can get it.)

Don't tell me to get Mac, please, because the software for my job is PC and there is no alternative. x(

[suston96]

23. Mac owners, please cancel the bragging!

I have been an Apple user since way back to the Franklin ACE (Apple II knock off).

It may be true that Macs are not targeted right now, in fact I believe that is true.

But any hacker worth his criminal pheromones is just salivating to shatter this Mac myth.

So please, knock it off and let's all go back to playing with our iPods.

And feeling desolated about our PC bretheren and sisteren.