Symantec content scanner contains flaws

Symantec Scan Engine is a popular TCP/IP server and programming interface used by third parties to include Symantec content scanning into proprietary applications. The vulnerabilities were discovered by researchers with Rapid7, who found the problems in version 5.0 of the software.

The first vulnerability is with the program's authentication system, which doesn't correctly authenticate web-based user logins. Remote users can utilize this vulnerability to bypass the system and gain access to the Scan Engine server.

The second vulnerability leaves the product open to man-in-the-middle attacks. Symantec Scan Engine 5.0 uses a static DSA key for SSL communication; it cannot be changed by end users and can be easily extracted.

Finally, the program also allows unauthenticated remote users to download any file located under its installation directory.

Symantec engineers reported on Friday that they are aware of these vulnerabilities and have worked to add fixes for all three in the anti-virus giant's latest product update. Symantec strongly recommended that customers immediately apply the latest update to protect against these threats.