167 matches found
Code injection
Multiple unspecified vulnerabilities in Symantec Altiris Deployment Solution 6.9 might allow remote attackers to execute arbitrary code via unknown client-side attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.17, as identified by 1 "Symantec Altiris Deployment...
CVE-2009-3178
Unspecified vulnerability in mm.exe in Symantec Altiris Deployment Solution 6.9 allows remote attackers to cause a denial of service via unknown attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.18, "Symantec Altiris Deployment Solution 6.9 DoS." NOTE: as of...
CVE-2009-3178
Technical details about CVE-2009-3178 are not publicly available in the provided documents. The materials only reference an unspecified DoS claim for Symantec Altiris Deployment Solution 6.9; monitor for updates.
CVE-2009-3179
Multiple unspecified vulnerabilities in Symantec Altiris Deployment Solution 6.9 might allow remote attackers to execute arbitrary code via unknown client-side attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.17, as identified by 1 "Symantec Altiris Deployment...
CVE-2009-3179
Technical details are not publicly available in the provided documents; monitor for updates.
Symantec Altiris Deployment Solution ActiveX Control Arbitrary File Download and Execute
This module allows remote attackers to install and execute arbitrary files on a users file system via AeXNSPkgDLLib.dll 6.0.0.1418. This module was tested against Symantec Altiris Deployment Solution 6.9 sp3. This module requires Metasploit: https://metasploit.com/download Current source:...
Authentication flaw
Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 does not properly restrict access to the listening port for the DBManager service, which allows remote attackers to bypass authentication and modify tasks or the Altiris Database via a connection to this service...
CVE-2009-3107
Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 does not properly restrict access to the listening port for the DBManager service, which allows remote attackers to bypass authentication and modify tasks or the Altiris Database via a connection to this service...
Code injection
The Aclient GUI in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 installs a client executable with insecure permissions Everyone:Full Control, which allows local users to gain privileges by replacing the executable with a Trojan horse program...
CVE-2009-3109
Unspecified vulnerability in the AClient agent in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430, when key-based authentication is being used between a deployment server and a client, allows remote attackers to bypass authentication and execute arbitrary commands as SYSTEM by...
CVE-2009-3108
The Aclient GUI in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 installs a client executable with insecure permissions Everyone:Full Control, which allows local users to gain privileges by replacing the executable with a Trojan horse program...
CVE-2009-3110
CVE-2009-3110 affects Symantec Altiris Deployment Solution 6.9.x prior to 6.9 SP3 Build 430. A race condition in the file transfer functionality allows a remote attacker to intercept file transfers by connecting to the transfer port before the legitimate client, potentially reading sensitive file...
CVE-2009-3109
Unspecified vulnerability in the AClient agent in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430, when key-based authentication is being used between a deployment server and a client, allows remote attackers to bypass authentication and execute arbitrary commands as SYSTEM by...
CVE-2009-3110
Race condition in the file transfer functionality in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 allows remote attackers to read sensitive files and prevent client updates by connecting to the file transfer port before the expected client does...
CVE-2009-3108
CVE-2009-3108 affects Symantec Altiris Deployment Solution 6.9.x prior to 6.9 SP3 Build 430. The Aclient GUI is installed with insecure permissions (Everyone: Full Control), enabling local users to escalate privileges by replacing the client executable with a Trojan horse. Impact is local privile...
CVE-2009-3107
Symantec Altiris Deployment Solution 6.9.x prior to 6.9 SP3 Build 430 is affected by CVE-2009-3107 due to improper access restriction on the DBManager service port. This allows remote attackers to bypass authentication and modify tasks or the Altiris Database via a connection to the DBManager. Mu...
CVE-2009-3109
CVE-2009-3109 affects Symantec Altiris Deployment Solution 6.9.x prior to 6.9 SP3 Build 430. The AClient agent, when key-based authentication is used, can be bypassed by spoofing the deployment server and issuing alternate commands before the handshake, allowing arbitrary commands to be executed ...
Altiris Deployment Solution Server DB Manager Unauthenticated Command Execution
The remote host is running a vulnerable version of Altiris Deployment Solution Server. Authentication is not required prior to sending commands to the DB Manager service. A remote attacker could exploit this to modify or read data from the Altiris database. C Tenable Network Security, Inc...
Symantec Altiris Deployment Solution文件传输竞争条件漏洞
BUGTRAQ ID: 36113 Symantec Altiris Deployment Solution是自动化的操作系统部署解决方案，用于从统一的位置部署和管理服务器、桌面和笔记本等。 Altiris Deployment Solution允许从服务器向部署的客户端传输文件。获得了网络访问且知道了为文件传输所分配端口的恶意用户可以通过连续多次连接到这个端口创造竞争条件，在合法客户端访问文件之前拦截这些文件的内容。成功攻击可能导致非授权的文件访问和/或部分的拒绝服务。 Symantec Altiris Deployment Solution 6.9.x 厂商补丁： Symantec...