SUMMARY

Symantec is aware of a potential race condition reported in the Symantec AntiVirus Scan Engine during initial installation.

AFFECTED PRODUCTS

Symantec AntiVirus Scan Engine (SAVSE) 4.3 for Solaris and Red Hat

ISSUES

Details
Symantec was alerted to the posting of information indicating a race condition vulnerability in the Symantec AntiVirus Scan Engine during installation. During the installation of the Symantec AntiVirus Scan Engine and the initial system update with Symantec Java LiveUpdate, there is a limited window of opportunity in which a local user could potentially exploit the targeted system. By creating a symbolic link, an attacker could cause Java LiveUpdate to append data to an unintended file, or to create a new file in an unintended location. In some circumstances, an unprivileged user may be able to gain elevated access to the system.

The Common Vulnerabilities and Exposures (CVE) initiative has assigned CVE Candidate name CAN-2004-0217 to this issue.

This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.

MITIGATION

Symantec Response
Symantec has developed a build update for Symantec AntiVirus Scan Engine 4.3 to address this issue. Customers can obtain a build update through their appropriate technical support channels.

The Symantec Antivirus Scan Engine update fully mitigates this issue. Symantec Java LiveUpdate 2.0 is also being strengthened to further address these types of issues. An update for Symantec Java LiveUpdate will be available soon.

Symantec recommends that build update for the Symantec AntiVirus Scan Engine be installed. In the event you cannot install the build update, customers should follow recommended workarounds to help mitigate the potential risk from this issue.

When installing Symantec AntiVirus Scan Engine, administrators should:

• Install the application on a trusted, restricted access host
   
• Modify /etc/liveupdate.conf and set the log file to be stored in the /opt/Symantec/LiveUpdate/ directory
   
• Modify the /opt/SYMCScan/bin/liveupdate.sh script and insert "umask 077" on the second line
  
  Note: Umask of 077 is recommended if possible, or umask 027 if group id is a system group or specific to the Symantec AntiVirus Scan Engine.