We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Warning over 'highly critical' Norton bug

Norton Antivirus users told to update now

A bug in the way Norton Antivirus uses the ActiveX programming language could cause serious problems for users of Symantec's products.

Yesterday, Symantec patched the flaw warning that a bug in two ActiveX controls used by Norton Antivirus could allow an attacker to run unauthorised software on a victim's computer. Security vendor Secunia rates the threat as "highly critical".

The flaw is an "input validation" error, meaning that Norton doesn't properly check the data it's receiving to ensure that it can't be mistaken for malicious commands. The bug affects users of the 2006 versions of Norton AntiVirus, Norton Internet Security and Norton System Works. Norton Internet Security 2006, Anti Spyware Edition is also affected.

Symantec advises these users to run the program's LiveUpdate feature as soon as possible to download the patch. Symantec's enterprise products, AntiVirus Corporate Edition and Symantec Client Security, are not affected by the bug.

These kind of ActiveX programming errors are common, but they can be nasty, said Johannes Ullrich, chief research officer for the SANS Institute. "People don't code ActiveX as carefully as they should," he said.

It's not clear how easily it will be to write attack code that takes advantage of the problem, but because Norton is so widely used, the flaw should be taken seriously, Ullrich added. "It's serious because potentially anybody that has Norton AntiVirus installed is now vulnerable," he said. "Now all that has to happen is for them to visit a malicious Web site."

Three months ago, a group of hackers underscored the problem with these ActiveX vulnerabilities, releasing details on one bug per day through May.


IDG UK Sites

The best iPhone 6 alternatives: Price and specs compared with the best smartphones

IDG UK Sites

The top 10 Apple products ranked by pixel density: Which Apple devices have the sharpest screens?

IDG UK Sites

SBTRKT's Look Away webcam-based interactive music video won't keep your gaze

IDG UK Sites

Retina MacBook Air release date rumours and specs: Gold 12in Retina MacBook Air almost 1cm thinner...