As reported by Yahoo! News, Symanted has issued a patch for a vulnerability in its corporate antivirus software that could allow an unauthorized person to access a company’s servers. The flaw, which found in version 9 of Symantec AntiVirus Corporate Edition product, exposes the server login name and password used by the administrator who authorizes updates to the software.

If I remember correctly, I’ve read that Symantec uses flat text file to store the authorized administrator’s login name and password. Since it’s a flat text file, the file is accessible to all users on the system, meaning workers across the enterprise could view the login name and password. The danger is most apparent if that same login and password are used for accessing other, more critical corporate systems.

The login information (username and password) is used by LiveUpdate, an automatic software update utility which bundled with all of Symantec AntiVirus software. After the client receives the updates from the LiveUpdate server, information about the transaction is stored in a local log file. Symantec said the LiveUpdate server login and password are included in that log file as clear text.

You can get the patch which fix the problem here.

Furthermore, Symantec advised customers to create a unique login and password for accessing LiveUpdate services, rather than using the same administrator login that provides broader system access.

[ Source ]