Symantec content scanner contains flaws

By

Symantec released a security advisory late last week for three vulnerabilities in the Symantec Scan Engine that could potentially allow remote access to the scan engine and give users the ability to open man-in-the-middle attacks.

Symantec Scan Engine is a popular TCP/IP server and programming interface used by third parties to include Symantec content scanning into proprietary applications. The vulnerabilities were discovered by researchers with Rapid7, who found the problems in version 5.0 of the software.


The first vulnerability is with the program's authentication system, which doesn't correctly authenticate web-based user logins. Remote users can utilize this vulnerability to bypass the system and gain access to the Scan Engine server.

The second vulnerability leaves the product open to man-in-the-middle attacks. Symantec Scan Engine 5.0 uses a static DSA key for SSL communication; it cannot be changed by end users and can be easily extracted.

Finally, the program also allows unauthenticated remote users to download any file located under its installation directory.

Symantec engineers reported on Friday that they are aware of these vulnerabilities and have worked to add fixes for all three in the anti-virus giant's latest product update. Symantec strongly recommended that customers immediately apply the latest update to protect against these threats.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Log In

  |  Forgot your password?