We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Warning over 'highly critical' Norton bug

Norton Antivirus users told to update now

A bug in the way Norton Antivirus uses the ActiveX programming language could cause serious problems for users of Symantec's products.

Yesterday, Symantec patched the flaw warning that a bug in two ActiveX controls used by Norton Antivirus could allow an attacker to run unauthorised software on a victim's computer. Security vendor Secunia rates the threat as "highly critical".

The flaw is an "input validation" error, meaning that Norton doesn't properly check the data it's receiving to ensure that it can't be mistaken for malicious commands. The bug affects users of the 2006 versions of Norton AntiVirus, Norton Internet Security and Norton System Works. Norton Internet Security 2006, Anti Spyware Edition is also affected.

Symantec advises these users to run the program's LiveUpdate feature as soon as possible to download the patch. Symantec's enterprise products, AntiVirus Corporate Edition and Symantec Client Security, are not affected by the bug.

These kind of ActiveX programming errors are common, but they can be nasty, said Johannes Ullrich, chief research officer for the SANS Institute. "People don't code ActiveX as carefully as they should," he said.

It's not clear how easily it will be to write attack code that takes advantage of the problem, but because Norton is so widely used, the flaw should be taken seriously, Ullrich added. "It's serious because potentially anybody that has Norton AntiVirus installed is now vulnerable," he said. "Now all that has to happen is for them to visit a malicious Web site."

Three months ago, a group of hackers underscored the problem with these ActiveX vulnerabilities, releasing details on one bug per day through May.


IDG UK Sites

Best Christmas 2014 UK tech deals, Boxing Day 2014 UK tech deals & January sales 2015 UK tech...

IDG UK Sites

LED vs Halogen: Why now could be the right time to invest in LED bulbs

IDG UK Sites

Christmas' best ads: See great festive spots studios have created to promote themselves and clients

IDG UK Sites

Why Apple shouldn't be blamed for exploitation in China and Indonesia