Symantec content scanner contains flaws

Symantec released a security advisory late last week for three vulnerabilities in the Symantec Scan Engine that could potentially allow remote access to the scan engine and give users the ability to open man-in-the-middle attacks.

Symantec Scan Engine is a popular TCP/IP server and programming interface used by third parties to include Symantec content scanning into proprietary applications. The vulnerabilities were discovered by researchers with Rapid7, who found the problems in version 5.0 of the software.

The first vulnerability is with the program's authentication system, which doesn't correctly authenticate web-based user logins. Remote users can utilize this vulnerability to bypass the system and gain access to the Scan Engine server.

The second vulnerability leaves the product open to man-in-the-middle attacks. Symantec Scan Engine 5.0 uses a static DSA key for SSL communication; it cannot be changed by end users and can be easily extracted.

Finally, the program also allows unauthenticated remote users to download any file located under its installation directory.

Symantec engineers reported on Friday that they are aware of these vulnerabilities and have worked to add fixes for all three in the anti-virus giant's latest product update. Symantec strongly recommended that customers immediately apply the latest update to protect against these threats.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.