Text 18189, 58 rader
Skriven 2006-05-25 21:44:04 av TOM WALKER (1:123/140)
Ärende: No Comment
==================
Thursday, May 25, 2006; Posted: 6:07 p.m. EDT (22:07 GMT)  
 
WASHINGTON (AP) -- Symantec Corp.'s leading antivirus software, which
protects some of the world's largest corporations and U.S. government
agencies, suffers from a flaw that lets hackers seize control of computers
to steal sensitive data, delete files or implant malicious programs,
researchers said Thursday.

Symantec said it was investigating the issue but could not immediately
corroborate the vulnerability. If confirmed, the threat to computer users
would be severe because the security software is so widely used and because
no action is required by victims using the latest versions of Symantec
Antivirus to suffer a crippling attack over the Internet.

Symantec has boasted that its antivirus products are installed on more than
200 million computers. A spokesman, Mike Bradshaw, said the company was
examining the reported flaw but described it as "so new that we don't have
any details."

Researchers from eEye Digital Security Inc. of Aliso Viejo, California,
discovered the vulnerability and provided evidence to Symantec engineers
this week, said eEye's chief hacking officer, Marc Maiffret. He
demonstrated the attack for The Associated Press.

eEye said it appeared consumer versions of Symantec's Norton Antivirus
software -- sold at retail outlets around the country -- were not
vulnerable to the flaw, though consumers who are provided Symantec's
corporate edition antivirus software by their employers for use at home may
be affected.

Maiffret's company -- which has discovered hundreds of similar flaws in
other software products -- also produces intrusion-protection software,
called "Blink," that he said already blocks such attacks and can operate
alongside Symantec's antivirus products.

Maiffret published a note about the company's discovery on its Web site but
pledged not to reveal details publicly that would help hackers attack
Internet users until after Symantec repairs its antivirus software. eEye
said it intends to describe the problem in detail privately for some of its
largest customers.

"People shouldn't panic," Maiffret said. "There shouldn't be any exploits
until a patch is produced."

The reported flaw comes at an awkward time for Symantec. Its chief
executive, John Thompson, has campaigned in recent months to convince
consumers they should trust Symantec -- not Microsoft Corp. -- to protect
their personal information.

Maiffret said eEye's testing showed the problem affects Symantec Antivirus
Version 10, including its corporate editions. He said Symantec's consumer
antivirus product, known as Norton Antivirus 2006, and its current security
suite -- which includes both antivirus and firewall features -- did not
appear to be vulnerable.

Copyright 2006 The Associated Press
--- Platinum Xpress/Win/WINServer v3.0pr5
 * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)