It’s shaping up to be a bad week for antivirus software company Symantec after researchers raised alarms about security holes and buggy code in two of the company’s products.
On Monday, Symantec acknowledged a report about a serious security flaw in Symantec Security Check, a free online service that enables users to scan their computer’s vulnerability to a number of security threats.
According to a message posted in the online discussion group Full-Disclosure last Sunday, an ActiveX control installed by the Security Check service contains a buffer overflow vulnerability that could enable a remote attacker to crash or run malicious code on systems that had the control installed.
The control, named “Symantec RuFSI Utility Class” or “Symantec RuFSI Registry Information Class,” is used to run the security check, but remains on systems after the scan is complete, according to a statement from Symantec.
After learning of the security hole on Monday, Symantec updated the ActiveX control in the Security Check service. Individuals who re-scanned their systems would receive the updated control.
Symantec also provided instructions on updating the control or removing it from affected systems.
However, security researchers monitoring the issue noted that simply updating the control still left users vulnerable to attack, especially if that control contained Symantec’s digital signature.
Attackers who have a copy of the flawed ActiveX code with a valid digital signature could trick Windows systems into accepting the control, opening that system to attack even if it did not already have the faulty component installed, according to a notice posted to Full-Disclosure by Jason Coombs, a software security expert in Hawaii.
Symantec acknowledged that the new control used the same digital signature as the flawed one and is “looking into” the issue, according to Anson Lee, product manager for Norton Internet Security at Symantec.
In the meantime, the company has encouraged Internet users to apply so-called “best practices” when prompted to download an ActiveX control.
Best practices included scrutinizing the signature of ActiveX components before agreeing to download them, Lee said.
Users should be suspicious when third party websites asked to download an ActiveX component signed by Symantec, according to Vincent Weafer, senior director of Symantec Security Response.
In the meantime, the flawed ActiveX control from the Security Check service could be an attractive target for hackers.
Symantec is in the process of creating a tool to help remove the ActiveX control from affected machines. A team at the company is also investigating ways to nullify the faulty control, but could not comment on any progress in that search, Lee said.