Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Symantec patches password hole

Symantec patches password hole

by Nikola Strahija on September 7th, 2005 Symantec has issued a patch for a serious vulnerability in its anti-virus software, which can allow unauthorised access to a company's servers.


The flaw, in version 9 of its AntiVirus Corporate Edition product, exposes the server login name and password used by the administrator who authorises updates to the software, Symantec said.

The product comes with a LiveUpdate client that can be set to check for product updates. After the client receives the updates from the LiveUpdate server, information about the transaction is stored in a local log file. The LiveUpdate server login and password are included in that log file as clear text, Symantec said.

The file is accessible to all users on the system, meaning workers across the enterprise could view the login name and password. The danger is most apparent if that same login and password are used for accessing other, more critical corporate systems.

The problem was first identified last week in a posting on Bugtraq. Symantec issued the patch late Friday.

Symantec has advised customers to create a unique login and password for accessing LiveUpdate services, rather than using the same administrator login that provides broader system access.


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »