The latest in a plague of security flaws affecting vendors has now caught up with Symantec.
A buffer overflow flaw in the Symantec Antivirus Scan Engine could let remote attackers run code on vulnerable machines, Symantec suggested in a security advisory.
The problem is relevant to various versions of the engine, which is the part of the security software that does the scanning for threats. Symantec rated the problem as "high" in terms of its risk impact, and strongly recommended its customers to use the security patches that are available to correct the problem.
The security hole lies in the web-based administrative interface of Symantec’s Antivirus Scan Engine, which is common to several of the company's antivirus products. An attacker could exploit it by sending a malformed request to the interface, according to security intelligence company iDefense.
Both Symantec and Kaspersky have been the subject of flaw reports issued by security researchers or intelligence specialists. But how is it that these security vendors always have to rely on someone else to find security holes, followed by the response that the threat is minimal and that a patch will be available soon? Why can these vendors not find their own security flaws before they release their products? Prevention is better than a cure.