Symantec: We Should Have Done More

Security experts earlier this week criticized the security vendor for not doing enough to inform its home and small-business users that their systems may be at risk (see Symantec Security Flaw Still A Threat).

The problem involves a buffer overflow problem in the Security Check service, which is used to check systems for common security vulnerabilities and attacks. The flaw was in an ActiveX control used by Security Check to examine a computer system. A buffer overflow attack on the "Symantec RuFSI Utility Class" control could crash a user's system and let an attacker run software of his or her choice.

Steve Cullen, senior VP of consumer and client product delivery for Symantec, said Friday that the company didn't do as much as it could have to inform customers about the vulnerability. "We probably hadn't done enough proactive communications, and we've taken steps to clean up that issue," he said.

Symantec posted an advisory on its Security Check Web site and on its home page Thursday that lists software vulnerabilities. It also tells users that they need to either rescan their systems using the Security Check service, which will fix the problem, or use a free tool Symantec has provided that removes the vulnerable ActiveX control from their desktops, Cullen says.

Nearly all of Symantec's ActiveX controls have a security feature that prevents the control from being used by any Web sites other than Symantec's, he says. But this particular ActiveX component lacked that security feature. "We've since gone through all of our ActiveX controls, and they all have that security feature," he says.

That feature is known as SiteLock and is designed to make sure that controls can only be used by Web domains that are trusted by the developer of the ActiveX control.

In an effort to get word out about the vulnerability to the millions of Symantec customers who may now have the faulty software on their systems, Cullen says the company will include information about the vulnerability and its cleanup process in an upcoming Symantec customer E-mail Newsletter. "We're trying to communicate the message to as many people as possible," he says.

Security experts who criticized Symantec's handling of the problem were justified, Cullen says. "I think it's fine for people to call us on that," he says. "And it's important that we remain objective about that. We're being as open and as proactive about this as possible."

This story courtesy of InformationWeek.