WASHINGTON -- Symantec Corp.'s leading antivirus software, which protects some of the world's largest corporations and US government agencies, suffers from a flaw that lets hackers seize control of computers to steal sensitive data, delete files, or implant malicious programs, researchers said yesterday.
Symantec said it was investigating the issue but could not immediately corroborate the vulnerability. If confirmed, the threat to computer users would be severe because the security software is so widely used, and because no action is required by victims using the latest versions of Symantec Antivirus to suffer a crippling attack over the Internet.
Symantec has boasted its antivirus products are installed on more than 200 million computers. A Symantec spokesman said the company was examining the reported flaw but described it as ``so new that we don't have any details."
Researchers from eEye Digital Security Inc. of Aliso Viejo, Calif., discovered the vulnerability and provided evidence to Symantec engineers this week, said eEye's chief hacking officer, Marc Maiffret.
EEye said it appeared consumer versions of Symantec's Norton Antivirus software -- sold at retail outlets around the country -- were not vulnerable to the flaw, although consumers who are provided Symantec's corporate edition antivirus software by their employers for use at home may be affected.
Maiffret's company -- which has discovered hundreds of similar flaws in other software products -- also produces intrusion-protection software, called ``Blink," that he said already blocks such attacks and can operate alongside Symantec's antivirus products.
Maiffret published a note about the discovery on eEye's website but pledged not to reveal details publicly that would help hackers until after Symantec repairs its software. EEye said it intends to describe the problem in detail privately for some of its largest customers.
The reported flaw comes at an awkward time for Symantec. Chief executive John Thompson has campaigned in recent months to convince consumers they should trust Symantec -- not Microsoft Corp. -- to protect their personal information.