Symantec patches critical Norton flaw

A bug in the way Norton AntiVirus software uses the ActiveX programming language could cause serious problems for users of Symantec's products.

On Thursday, Symantec patched the flaw warning that a bug in two ActiveX controls used by Symantec's client software could allow an attacker to run unauthorized software on a victim's computer. Security vendor Secunia ApS rates the problem as "highly critical."

The flaw is an "input validation" error, meaning that Norton doesn't properly check the data it's receiving to ensure that it can't be mistaken for malicious commands. The bug affects users of the 2006 versions of Norton AntiVirus, Norton Internet Security, and Norton System Works. Norton Internet Security 2006, Anti Spyware Edition is also affected.

Symantec advises these users to run the program's LiveUpdate feature as soon as possible to download the patch. Symantec's enterprise products, AntiVirus Corporate Edition and Symantec Client Security, are not affected by the bug.

These kind of ActiveX programming errors are common, but they can be nasty, said Johannes Ullrich, chief research officer for the SANS Institute. "People don't code ActiveX as carefully as they should," he said.

It's not clear how easily it will be to write attack code that takes advantage of the problem, but because Norton is so widely used, the flaw should be taken seriously, Ullrich added. "It's serious because potentially anybody that has Norton AntiVirus installed is now vulnerable," he said. "Now all that has to happen is for them to visit a malicious Web site."

Three months ago, a group of hackers underscored the problem with these ActiveX vulnerabilities, releasing details on one bug per day through May.