# MA-623.072016: MyCERT Alert - Symantec and Norton Security Products Contain Critical Vulnerabilities

**Date:** 09 Jul 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-623.072016  
**Advisory ID:** MA-623.072016

---

####
**1.0 Introduction**
Symantec and Norton branded antivirus products contain multiple vulnerabilities. List of the vulnerabilities can be referred to section 4.3 of this advisory. Users and administrators are encouraged to review Symantec Security Advisory SYM16-010 and SYM16-011 and apply the necessary updates.
**2.0 Impact**
The exploitation of this vulnerability could potentially allow a remote and unauthenticated attacker to run arbitrary code at root or SYSTEM privileges. Some of the vulnerabilities require no user interaction and are network-aware, which could result in a wormable-event.
**3.0 Affected Products**
All Symantec and Norton branded antivirus products in Windows, OS X, and Linux environments.
**4.0 Recommendation**
MyCERT highly recommends users or administrators of these applications to update to the latest version of the affected products:
> 4.1 Symantec Security Advisory SYM16-010
>
> Refer to:
> <https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_00>
>
> 4.2 Symantec Security Advisory SYM16-011
>
> Refer to:
> <https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01>
>
> 4.3 The vulnerabilities are listed below:
>
> - CVE-2016-2207
>   Symantec Antivirus multiple remote memory corruption unpacking RAR
>
> - CVE-2016-2208
>   Symantec antivirus products use common unpackers to extract malware binaries when scanning a system. A heap overflow vulnerability in the ASPack unpacker could allow an unauthenticated remote attacker to gain root privileges on Linux or OSX platforms. The vulnerability can be triggered remotely using a malicious file (via email or link) with no user interaction.
>
> - CVE-2016-2209
>   Symantec: PowerPoint misaligned stream-cache remote stack buffer overflow
>
> - CVE-2016-2210
>   Symantec: Remote Stack Buffer Overflow in dec2lha library
>
> - CVE-2016-2211
>   Symantec: Symantec Antivirus multiple remote memory corruption unpacking MSPACK Archives
>
> - CVE-2016-3644
>   Symantec: Heap overflow modifying MIME messages
>
> - CVE-2016-3645
>   Symantec: Integer Overflow in TNEF decoder
>
> - CVE-2016 -3646
>   Symantec: missing bounds checks in dec2zip ALPkOldFormatDecompressor::UnShrink
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#63001a0106115a5a5a23001a01061110060016110a171a4d0e1a) or [[email protected]](/cdn-cgi/l/email-protection#54392d3731262014392d373126207a3b26337a392d) 
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- Symantec Releases Security Updates
<https://www.us-cert.gov/ncas/current-activity/2016/06/29/Symantec-Releases-Security-Updates>
- Symantec and Norton Security Products Contain Critical Vulnerabilities
<https://www.us-cert.gov/ncas/alerts/TA16-187A>
- US-CERT Issues Alert Over Severe Security Bugs In Symantec, Norton Products
<http://www.darkreading.com/vulnerabilities---threats/us-cert-issues-alert-over-severe-security-bugs-in-symantec-norton-products/d/d-id/1326170>?