June 30, 2016 By Larry Loeb 2 min read

Tavis Ormandy, a U.K.-based security expert for Google, has found a massive hole in 25 Symantec security products, which he outlined on the company’s Project Zero blog. Their vulnerabilities were discovered in Symantec’s enterprise products as well as their personal ones.

Severe Symantec Vulnerabilities

These holes could allow cybercriminals to compromise target machines just by sending malicious and self-replicating code via an unopened email or unclicked link. No user action of any kind is required for this worm malware to carry out its exploit.

Ormandy described the severity in no uncertain terms. “These vulnerabilities are as bad as it gets. They don’t require any user interaction, they affect the default configuration and the software runs at the highest privilege levels possible,” he wrote on Project Zero. “In certain cases on Windows, vulnerable code is even loaded into the kernel, resulting in remote kernel memory corruption.”

Symantec has issued its own advisory about the problem and said it was not aware of any malware that currently used the exploit.

Since Symantec uses the same affected core engine across its entire product line, both Symantec and Norton antivirus products will be vulnerable. Some of these affected products are:

  • Norton Security, Norton 360 and other legacy Norton products;
  • Symantec Endpoint Protection;
  • Symantec Email Security;
  • Symantec Protection Engine; and
  • Symantec Protection for SharePoint Servers.

Plan to Patch

Symantec indicated that it will disseminate the necessary patches. It said in the advisory that although its Norton products were updated remotely, other branded tools would be split between automatic updates and manual ones.

That’s right: Enterprise-related products need to be manually updated. Exact ways to perform these patches are available though Symantec support.

Ormandy pointed out there is more happening in this situation than what Symantec is patching. He noted that “a quick look at the decomposer library shipped by Symantec showed that they were using code derived from open-source libraries like libmspack and unrarsrc, but hadn’t updated them in at least seven years.”

It’s time for users to get on the ball with open-source updates for these Symantec vulnerabilities. Double-check your devices to determine how to update and what remediation measures to take.

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today