Symantec plugs antivirus hole
Published: 07 Sep 2005 08:50 BST
Symantec late on Friday released an update for AntiVirus Corporate Edition 9.0 to fix a security weakness that was disclosed earlier last week. The unpatched software stores usernames and passwords in plain text in a log file when connecting to an internal LiveUpdate server for updates. One scenario in which these credentials could be abused is by a local attacker to gain higher privileges, according to a post on the Bug traq mailing list last week.
Symantec has now updated its LiveUpdate client to address the problem, according to a security advisory. Still, the company recommends that LiveUpdate user accounts are unique for accessing LiveUpdate only, and have no other system access. Symantec ranks the password problem "medium" risk.
Did you find this article useful?
72 out of 148 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
