ALERT -- New Symantec Anti-Virus vulnerabilities announced

On July 11th Symantec announced two vulnerabilities in Symantec
Anti-Virus. The vulnerabilities involve the Decomposer component that
allows Symantec Anti-Virus to scan inside of archive files while
scanning for malicious contact. The most serious vulnerability could
allow arbitrary execution of code when scanning a malicious CAB archive.
There are currently no exploits reported for these vulnerabilities, and
SNS is urging all campus users to update their Symantec software before
exploits are released.

All versions of Symantec Anti-Virus prior to 10.1.6 (included in
Symantec Client Security for Windows prior to 3.1.6 MR6) are vulnerable.
The latest, non-vulnerable version of Symantec is available at
http://software-central.berkeley.edu. Since this exploit does not
involve the network component, it affects both managed and unmanaged
clients so all vulnerable clients should be patched as soon as possible.
We will have the latest x64 client posted shortly -- in the meantime x64
clients can be updated by downloading the full administrators CD from
the Symantec Client Security section of
http://software-central.berkeley.edu. Macintosh clients and Symantec
Anti-Virus 10.2 for Windows Vista are not affected by this vulnerability.

For more information see:
http://www.symantec.com/avcenter/security/Content/2007.07.11f.html

-- 
Allison Henry
System and Network Security
University of California, Berkeley
http://security.berkeley.edu
------------------------------------------------------------------------
The following was automatically added to this message by the list server:
To learn more about Micronet, including how to subscribe to
or unsubscribe from its mailing list and how to find out
about upcoming meetings, please visit the Micronet Web site:
http://micronet.berkeley.edu/
Messages you send to this mailing list are public and world-viewable,
and the list's archives can be browsed and searched on the Internet.
This means these messages can be viewed by (among others) your bosses,
prospective employers, and people who have known you in the past.