New Worm Attacks Through Symantec Antivirus App

By NewsFactor Network | December 18, 2006

A new worm is making the rounds, attacking some business computers through a known — and already patched — flaw in a popular antivirus software suite from security firm Symantec.

The worm, called “Big Yellow” and discovered initially by eEye Digital Security, zaps vulnerable computers with malicious code and turns them into remote-controlled zombie machines capable of wreaking all sorts of havoc at the behest of the hackers responsible for creating the worm.

Big Yellow exploits a vulnerability in the remote-management interface for Symantec AntiVirus and Symantec Client Security software packages.

Marc Maiffret, eEye’s founder and CTO, said that the threat appears to be widespread and that eEye is tracking a server used by the worm to download part of its malicious payload. That server has pushed data out to more than 60,000 PCs already, according to eEye’s data.

Old Vulnerability

Although eEye discovered and reported this vulnerability in May 2006 and worked with Symantec to create a patch at that time, many I.T. departments have not yet deployed the fix, Maiffret said. “Given the rapid discovery of critical security vulnerabilities within desktop applications other than Microsoft, the release of malware of this magnitude targeting non-Microsoft software was only a matter of time,” noted Maiffret.

Maiffret also said users need to realize that attacks not only target Microsoft software but also the myriad applications that are scattered throughout a corporate network, from antivirus software to media applications. These non-Microsoft desktop applications, many of which are not even approved by I.T. departments, will become the enterprise’s biggest point of vulnerability, according to Maiffret.

However, Natalie Lambert, an analyst with Forrester Research, said that while the flaw is potentially fatal to some systems, the fact that a fix for the hole was first pushed out by Symantec last May means diligent users can stop the worm in its…

Bookmark and Share :-)