The company confirmed that a segment of its source code had been stolen by a hacking group in 2006 that made pcAnywhere vulnerable.
However, Symantec said it had since taken steps to prevent a similar incident from occurring again, and that there were no indications that customer information had been impacted or exposed.
“Our investigation continues to indicate that the theft is limited to only the code for the 2006 versions of Norton Antivirus Corporate Edition; Norton Internet Security; Norton SystemWorks (Norton Utilities and Norton GoBack); and pcAnywhere,” the company said.
News of the source code theft emerged earlier this month when hacking group Lords of Dharmaraja threatened to post it online.
Symantec initially said there was no risk to users as the stolen code was six years old, advising them simply to make sure the most recent version of the products had been downloaded.
The company has reiterated that advice, but has now warned that users of Symantec’s pcAnywhere do have increased risk as a result of the source code theft.
“Our current analysis shows that all pcAnywhere 12.0, 12.1 and 12.5 customers are at increased risk, as well as customers using prior versions of the product,” the company said.
Symantec has published security guidelines, which recommend disabling the product until the firm releases a final set of software updates that resolve currently known vulnerability risks.
For customers that require pcAnywhere for business-critical purposes, it is recommended they understand the current risks, ensure pcAnywhere 12.5 is installed, apply all relevant patches as they are released, and follow the general security best practices in the guidelines.
“Customers that are not following general security best practices are also susceptible to man-in-the-middle attacks which can reveal authentication and session information. General security best practices include endpoint, network, remote access, and physical security, as well as configuring pcAnywhere in a way that minimizes potential risks,” the company said.
This story was first published by Computer Weekly