Google has criticized antivirus manufacturing company Symantec for the vulnerabilities in their antivirus products and also warned the company to get the issue fixed as quickly as possible. Google has a Project Zero team which searches for zero day code flaws by providing different antivirus companies a period of 90 days with 2 weeks of extension to fix certain vulnerabilities. Researcher Tavis Ormandy was utterly disappointed with the way Symantec responded. “Just emailing a file to a victim or sending them a link to an exploit is enough to trigger it — the victim does not need to open the file or interact with it in any way”, said Ormandy.
Symantec was the first company to submit the fixes and according to Google, the vulnerabilites that were found in the patches are nothing but dangerous. Ormandy found a buffer overflow flaw in the company’s unpacker which scans for hidden trojans and worms. This flaw is a dangerous one as the bug may easily destroy an enterprise fleet. The unpacker also have the probability to have kernel access.
He severely vituperated Symantec for such a mishap.
Symantec dropped the ball here. A quick look at the decomposer library shipped by Symantec showed that they were using code derived from open source libraries … but hadn’t updated them in at least 7 years
Here are some of the important consumer-oriented products by Symantec are included in the list:
Norton 360
Norton Antivirus
Norton Internet Security
Norton Security
