Softpedia >News >Security
Softpedia Homepage   

Google Researcher Finds Gaping Security Hole in Symantec Antivirus

To exploit the issue, an attacker only needs to spam you with links or send an email with a malicious file attachment

May 17, 2016 10:00 GMT  ·  By
Symantec patches huge security hole in its antivirus programs
   Symantec patches huge security hole in its antivirus programs

Tavis Ormandy, a security researcher working for Google's Project Zero, discovered and helped Symantec fix a grave security issue affecting its Symantec Antivirus Engine, the core of many of Symantec's security products.

Ormandy explains that, in some situations when certain type of data reaches the Symantec Antivirus Engine (SAE), the product handles those files in an insecure manner that leads to a buffer overflow.

The security bug is trivial to exploit

"When parsing executables packed by an early version of aspack, a buffer overflow can occur in the core Symantec Antivirus Engine used in most Symantec and Norton branded Antivirus products," Ormandy says. "The problem occurs when section data is truncated, that is, when SizeOfRawData is greater than SizeOfImage."

This causes the security engine to crash in a non-standard way that then grants the attacker root privileges and the power to execute code on the machine. The security issue, tracked with the CVE-2016-2208 identifier, affects all operating systems: Mac, Linux, and Windows.

Ormandy says the issue can be exploited in a very simple manner. Because the flaw resides in the scanning engine itself, which opens and reads ANY file, not just those the user manually selected for a scan, the crook can simply send an exploit package via email or a link pointing to a Web-hosted exploit.

The engine will scan its content automatically and compromise the user's machine, no user interaction needed.

Exploitation on Windows leads to BSOD

On Windows computers, Ormandy says this is even more of an issue because the scan engine runs directly on the Windows kernel.

Exploiting this bug on Windows leads to the corruption of the kernel's Ring 0, the operating system's level with the most privileges that interacts most directly with the physical hardware such as the CPU and memory. This leads to a state of "kernel panic," which sometimes can result in a BSOD (Blue Screen of Death).

CVE-2016-2208 affects Symantec products such as Symantec Endpoint Antivirus, Norton Antivirus, Symantec Scan Engine, and Symantec Email Security. Ormandy claims that, in theory, the bug should affect any other product where Symantec deployed SAE.

The researcher disclosed the problem to Symantec, and the company issued a patch that customers can download and apply to their software.