#Semantic norton antivirus driver

The flaws reside in the engine the products use to reverse the compression tools malware developers use to conceal their malicious payloads. Network administrators should keep scenarios like this in mind when deciding to deploy Antivirus, it’s a significant tradeoff in terms of increasing attack surface. Because no interaction is necessary to exploit it, this is a wormable vulnerability with potentially devastating consequences to Norton and Symantec customers.Īn attacker could easily compromise an entire enterprise fleet using a vulnerability like this.

#Semantic norton antivirus driver

Ormandy continued:īecause Symantec uses a filter driver to intercept all system I/O, just emailing a file to a victim or sending them a link to an exploit is enough to trigger it - the victim does not need to open the file or interact with it in anyway. Ormandy warned that the vulnerability is unusually easy to exploit, allowing the exploits to spread virally from machine to machine over a targeted network, or potentially over the Internet at large. The post was published shortly after Symantec issued its own advisory, which listed 17 Symantec enterprise products and eight Norton consumer and small business products being affected. In certain cases on Windows, vulnerable code is even loaded into the kernel, resulting in remote kernel memory corruption.'

'They don’t require any user interaction, they affect the default configuration, and the software runs at the highest privilege levels possible.

'These vulnerabilities are as bad as it gets,' Tavis Ormandy, a researcher with Google's Project Zero, wrote in a blog post. Much of the product line from security firm Symantec contains a raft of vulnerabilities that expose millions of consumers, small businesses, and large organizations to self-replicating attacks that take complete control of their computers, a researcher warned Tuesday.