Symantec Update Inadvertently Cripples Certain Windows XP Machines
Security firm Symantec is busy cleaning up a bit of egg on its face after pushing out a signature update that decided not to play nice with some Windows XP machines. Symantec disclosed the problem on its website, saying that the SNAFU only affected machines running a combination of Windows XP, the latest version of its SONAR technology, and certain third party software.
"The root cause of the issue was an incompatibility due to a three way interaction between some third party software that implements a file system driver using kernel stack based file objects – typical of encryption drivers, the SONAR signature and the Windows XP Cache manager. The SONAR signature update caused new file operations that create the conflict and led to the system crash," Symantec explains.
Symantec says these problems aren't typical of its products and pointed out that its quality assurance process for SONAR signatures is quite extensive, starting with a peer review and vetting of all signatures, and continuing with true positive testing, false positive testing, functional testing of all signature content, and a compatibility test. Even still, Symantec missed this particular hiccup, and as a result, is now restructuring its testing process and withholding future SONAR updates until the new system is in place.
"The root cause of the issue was an incompatibility due to a three way interaction between some third party software that implements a file system driver using kernel stack based file objects – typical of encryption drivers, the SONAR signature and the Windows XP Cache manager. The SONAR signature update caused new file operations that create the conflict and led to the system crash," Symantec explains.
Symantec says these problems aren't typical of its products and pointed out that its quality assurance process for SONAR signatures is quite extensive, starting with a peer review and vetting of all signatures, and continuing with true positive testing, false positive testing, functional testing of all signature content, and a compatibility test. Even still, Symantec missed this particular hiccup, and as a result, is now restructuring its testing process and withholding future SONAR updates until the new system is in place.
