Initial Publication Date: Advisory Status: Advisory Severity: CVSS Base Score:Legacy ID
22 Mar 2004 Closed Low 3.7 SYM04-006
Symantec is aware of a potential race condition reported in the Symantec AntiVirus Scan Engine during initial installation.
Symantec AntiVirus Scan Engine (SAVSE) 4.3 for Solaris and Red Hat
Symantec was alerted to the posting of information indicating a race condition vulnerability in the Symantec AntiVirus Scan Engine during installation. During the installation of the Symantec AntiVirus Scan Engine and the initial system update with Symantec Java LiveUpdate, there is a limited window of opportunity in which a local user could potentially exploit the targeted system. By creating a symbolic link, an attacker could cause Java LiveUpdate to append data to an unintended file, or to create a new file in an unintended location. In some circumstances, an unprivileged user may be able to gain elevated access to the system.
The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate name CAN-2004-0217 to this issue.
This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.
Symantec has developed a build update for Symantec AntiVirus Scan Engine 4.3 to address this issue. Customers can obtain a build update through their appropriate technical support channels.
The Symantec Antivirus Scan Engine update fully mitigates this issue. Symantec Java LiveUpdate 2.0 is also being strengthened to further address these types of issues. An update for Symantec Java LiveUpdate will be available soon.
Symantec recommends that build update for the Symantec AntiVirus Scan Engine be installed. In the event you cannot install the build update, customers should follow recommended workarounds to help mitigate the potential risk from this issue.
When installing Symantec AntiVirus Scan Engine, administrators should:
Install the application on a trusted, restricted access host
Modify /etc/liveupdate.conf and set the log file to be stored in the /opt/Symantec/LiveUpdate/ directory
Modify the /opt/SYMCScan/bin/liveupdate.sh script and insert "umask 077" on the second line
Note: Umask of 077 is recommended if possible, or umask 027 if group id is a system group or specific to the Symantec AntiVirus Scan Engine.
This is machine translated content
Login to Subscribe
Please login to set up your
Would you like to be subscribed to future notifications for this article?
For security reasons, your link to this document has expired. Please click on the attachment link to access this file.
The attachment that you are looking for no longer exists.
There has been an issue retrieving your attachment. Please try again.
Currently server is down.
Didn't find the article you were looking for? Try these resources.