In association with heise online

27 August 2009, 10:03

IBM and Symantec patch critical holes in their products

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

Several of Symantec's mail security and data loss prevention products contain a vulnerability that can be exploited to compromise a system when parsing files. The problem is caused by an integer or heap overflow in the KeyView SDK software library by vendor Autonomy. Symantec products use this library for processing certain document formats. The actual vulnerability is contained in a function for processing Excel-97 files in the xlssr.dll file and allows attackers to inject and execute arbitrary code. It appears that an attacker only needs to attach a specially crafted Excel table to an email and send it to a system for processing to be successful.

Among the affected programs are Symantec Mail Security for Domino 8.0, Symantec Mail Security for Microsoft Exchange 6.x, Symantec BrightMail Appliance 8.0.1 and Symantec Data Loss Prevention Enforce/Detection Servers for Windows 9.0.1. A complete list can be found in Symantec's original advisory. The vendor has released hot fixes to close the hole.

In addition to the Symantec products, the vulnerability also affects IBM's Lotus Notes, which also use the KeyView SDK. IBM has released a separate advisory which states that Lotus Notes 7.x, 8.x and 8.5.x are vulnerable. The Lotus Notes servers are not affected. On the clients, however, users have to manually open an attachment with the Viewer to fall victim to the attack. IBM has released patches for 8.5.x, 8.0x and 7.x. For the series 6.x and 5.x versions, the vendor recommends that users disable the Viewer. Instructions how to do this can be found in IBM's advisory.

Holes in the KeyView SDK already prompted Symantec and IBM to release security updates in April 2008 and in October 2007.

See also:


Print Version | Send by email | Permalink:

  • July's Community Calendar

The H Open

The H Security

The H Developer

The H Internet Toolkit