Since I could find no iformation whatsoever in our portal regarding this extremely dangerous vulnerability the Google Zero team identified, I decided to enter a support ticket to ask where us SBE subscribers could get the patch. This is the response I got from Symantec:
==========================================
Thursday, June 30, 2016 3:36:06 PM:
Symantec’s Endpoint Protection Small Business Edition (SEP SBE) team has been working with our Norton and SEP development team for updates to fix the recently announced vulnerabilities over the last several weeks. The SEP and Norton teams have just released updated agents and our SEP SBE team is in the process of packaging and testing the versions of these agents for inclusion in SEP SBE (cloud).
We are working on speeding up the delivery of the new SEP SBE (cloud) agents as much as possible but we need to make sure they are properly tested and don’t create quality problems or further risks. We expect to release the new SEP SBE (cloud) agent for Servers in early July and the agent for Workstations in mid-late July.
Once these are available it will be for new installs and manual upgrading of the clients. We are also looking at other delivery options for agents such as automated updates via Live Update expected at some point later in July. We will be providing updates via the portal and partner portal with more details on alternative deployment/update options once they are available.
Symantec has released a set of AntiVirus definitions in an effort to block/detect attempts at exploitation. However to fully mitigate the identified vulnerabilities, Symantec recommends applying the required patches to the affected agents as soon as they are made available.
Customers can also reduce risk of attacks on these or other vulnerabilities by training users to avoid opening attachments from unknown senders or clicking links in unsolicited or suspicious emails.
=============================
First off I find the "early July" for servers and "mid-late July" for worksatation time-frame to be totally unacceptable. Sorry, but the mid-late July estimate is shocking and quite scary to me. Symantec should be working around the clock (if not already) and throw any and all and extra resources if need be at developing and deploying this fix. In addition, I had to submit a support ticket just get this info. Why wasn't I notified by email or why isn't it posted on the main page of our portal in bold red that there is a serious vulnerability?? There is a critical flaw with the product we trust to protect our company resources and data and we get no warning whatsoever. Third, it looks like we're going to have touch each machine to fix this problem. Boy, that should be fun since 2/3rds of our machines are remote.
This is a product flaw, not a user flaw, and that last paragraph in their response doesn't even apply to this vulnerability. It is triggered just by recieving an infected email or perhaps if a public interfacing server or system is comprised. The payload according to reports doesn't even need to be executed or opened.
Symantec - Please fix this ASAP and email the defined Admin contacts and post information in our portal as soon as possible - hopefully BEFORE mid-late July - regarding the process to fix this issue!