Norton Liveupdate Products Compromised

[pjd9000]

Issue: Norton user escalation
OS: Windows
Product: Symantec LiveUpdate
Products affected: Symantec LiveUpdate 1.70.x through 1.90.x
: Norton SystemWorks 2001-2004
: Norton AntiVirus (and Pro) 2001-2004
: Norton Internet Security (and Pro) 2001-2004
: Symantec AntiVirus for Handhelds v3.0

There is a security hole in the current version of the live update software that allows local users to access SYSTEM privileges on the local machine. This gives users access to functions that they would not normally be able to get. This would allow, for example, someone with user privileges to gain administrator privileges. While not yet tested for remote applications, the possibility exists. Symantec has been informed of the issue and has already patched their Live Update software.

More Information can be found at:
http://securityresponse.symantec.com...004.01.12.html


If this was already posted, sorry, alot of people use norton so I thought it would be important.

[MURACU]

Thanks for the info Pj. I much prefere to have information like this twice rather than not at all.