Update Protection against Symantec AppStream Client LaunchObj ActiveX Control Program Execution

A remote code execution vulnerability was reported in Symantec AppStream Client. The AppStream Client is part of a Software Virtualization Solution SVS which allows streaming of virtual applications to users in an enterprise environment using the AppStream Server. The vulnerability is due to...

CVE-2008-4388

The LaunchObj ActiveX control before 5.2.2.865 in launcher.dll in Symantec AppStream Client 5.2.x before 5.2.2 SP3 MP1 does not properly validate downloaded files, which allows remote attackers to execute arbitrary code via the installAppMgr method and unspecified other methods...

DSquare Exploit Pack: D2SEC_APPSTREAM

Name| d2secappstream ---|--- CVE| CVE-2008-4388 Exploit Pack| D2ExploitPack Description| Symantec AppStream Client LaunchObj ActiveX Arbitrary Code Execution Vulnerability Notes|...

Code injection

The LaunchObj ActiveX control before 5.2.2.865 in launcher.dll in Symantec AppStream Client 5.2.x before 5.2.2 SP3 MP1 does not properly validate downloaded files, which allows remote attackers to execute arbitrary code via the installAppMgr method and unspecified other methods...

CVE-2008-4388

The LaunchObj ActiveX control before 5.2.2.865 in launcher.dll in Symantec AppStream Client 5.2.x before 5.2.2 SP3 MP1 does not properly validate downloaded files, which allows remote attackers to execute arbitrary code via the installAppMgr method and unspecified other methods...

CVE-2008-4388

CVE-2008-4388 affects Symantec AppStream Client 5.x with the LaunchObj ActiveX control (launcher.dll) prior to 5.2.2 SP3 MP1. The issue arises in the installAppMgr() method (and unspecified other methods), where downloaded files are not properly validated, enabling remote code execution via a cra...

Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execute

This module exploits a vulnerability in Symantec AppStream Client 5.x. The vulnerability is in the LaunchObj ActiveX control launcher.dll 5.1.0.82 containing the "installAppMgr" method. The insecure method can be exploited to download and execute arbitrary files in the context of the currently...

Symantec AppStream Client LaunchObj ActiveX Control Multiple Unsafe Methods (SYM09-001)

The version of the LaunchObj ActiveX control, a component included with Symantec AppStream Client / Altiris Streaming Agent and installed on the remote Windows host, reportedly contains a number of unsafe methods, such as 'installAppMgr', that can be used to download and execute arbitrary code. I...

Symantec AppStream客户端LaunchObj ActiveX控件任意文件下载漏洞

BUGTRAQ ID: 33247 CVECAN ID: CVE-2008-4388 Symantec AppStream是Windows的应用程序部署框架。 AppStream Windows客户端所提供的LaunchObj ActiveX控件没有安全地调用installAppMgr方式，如果用户受骗访问了恶意网页并对该方式传送了特制参数的话，就会导致向用户系统下载并执行任意代码。 Symantec AppStream Client 5.2 临时解决方法： 在IE中禁用LaunchObj ActiveX控件，为以下CLSID设置kill bit：...

Symantec AppStream ActiveX Unauthorized Access

SUMMARY Vulnerabilities were reported in an ActiveX control that Symantecs AppStream 5.2.x Client installs. Exploitation of this issue could possibly lead to unauthorized information disclosure, system information corruption or potentially allow arbitrary code execution in the context of the user...

Symantec AppStream LaunchObj ActiveX control vulnerable to arbitrary code download and execution

Overview The Symantec AppStream LaunchObj ActiveX control contains methods that can be used to download and execute arbitrary code. Description Symantec AppStream is an application deployment framework for Microsoft Windows. One of the components of the AppStream Windows Client is an ActiveX...