Symlink Race Bugs Found in 28 Antivirus Products
Security researchers at RACK911 Labs said in a recent report that they found "symlink race" vulnerabilities in 28 of today's most popular antiviruses. According to RACK911, the flaws can be exploited by an attacker to delete files used by the antivirus or by the operating system, resulting in crashes or rendering the computer unusable. The vulnerability at the heart of these bugs is called the " symlink race " explains ZDNet Dr. Vesselin Bontchev, member of the National Laboratory of Virology of the Bulgarian Academy of Sciences. A symbolic link vulnerability occurs when you link a malicious file and a legitimate file together, and end up performing malicious actions on the legitimate file. Symlink race vulnerabilities are often used to link malicious files to higher privilege items, resulting in the elevation of privilege attacks. “This is a very real and ancient problem with operating systems that allow concurrent processes,” Dr. Bontchev told ZDNet....