Tavis Ormandy, a U.K.-based security expert for Google, has found a massive hole in 25 Symantec security products, which he outlined on the company’s Project Zero blog. Their vulnerabilities were discovered in Symantec’s enterprise products as well as their personal ones.

Severe Symantec Vulnerabilities

These holes could allow cybercriminals to compromise target machines just by sending malicious and self-replicating code via an unopened email or unclicked link. No user action of any kind is required for this worm malware to carry out its exploit.

Ormandy described the severity in no uncertain terms. “These vulnerabilities are as bad as it gets. They don’t require any user interaction, they affect the default configuration and the software runs at the highest privilege levels possible,” he wrote on Project Zero. “In certain cases on Windows, vulnerable code is even loaded into the kernel, resulting in remote kernel memory corruption.”

Symantec has issued its own advisory about the problem and said it was not aware of any malware that currently used the exploit.

Since Symantec uses the same affected core engine across its entire product line, both Symantec and Norton antivirus products will be vulnerable. Some of these affected products are:

• Norton Security, Norton 360 and other legacy Norton products;
• Symantec Endpoint Protection;
• Symantec Email Security;
• Symantec Protection Engine; and
• Symantec Protection for SharePoint Servers.

Plan to Patch

Symantec indicated that it will disseminate the necessary patches. It said in the advisory that although its Norton products were updated remotely, other branded tools would be split between automatic updates and manual ones.

That’s right: Enterprise-related products need to be manually updated. Exact ways to perform these patches are available though Symantec support.

Ormandy pointed out there is more happening in this situation than what Symantec is patching. He noted that “a quick look at the decomposer library shipped by Symantec showed that they were using code derived from open-source libraries like libmspack and unrarsrc, but hadn’t updated them in at least seven years.”

It’s time for users to get on the ball with open-source updates for these Symantec vulnerabilities. Double-check your devices to determine how to update and what remediation measures to take.