Tech Shout!

Earlier this week, in an advisory security giant Symantec cautioned that there were flaws in its Scan Engine, a programming interface, which enables third parties to slot in scanning technologies into their applications. The vulnerability has been rated as “medium risk.”

As per the advisory, the first problem lies within an issue in validating Web-based logins. “Anyone with knowledge of the underlying communication mechanism can control the Scan Engine server,” the notice reads.

Due to another flaw, the program is opened up to a “man-in-the-middle attack.” According to Symantec, the DSA key used for SSL communications is easily extracted.

A third flaw enables remote users to download any file in the installation directory of the program. With the help of regular or specially crafted HTTP requests, the information could be easily accessed.

However Symantec stressed that these flaws only affect the Scan Engine and none of its desktop applications.

Users are advised to upgrade to Symantec Scan Engine 5.1 in order to guard themselves from the flaw. At this time, there are no known available exploits. However, proof-of-concept code has already been published, security researchers caution.