CVE-2008-2290

CVE-2008-2290 affects Symantec Altiris Deployment Solution Agent in 6.8.x and 6.9.x prior to 6.9.176. It is described as an unspecified local privilege escalation via the Agent user interface, with a CVSS v2 base score of 7.2 (LOCAL attack vector, HIGH impact). Public references note multiple loc...

CVE-2008-2291

Symantec Altiris Deployment Solution 6.8.x and 6.9.x prior to 6.9.176 are affected by CVE-2008-2291 due to an insecure credential mechanism in axengine.exe. The service, listening on TCP port 402, generates domain credentials with a fixed salt or no salt at all, enabling remote attackers to guess...

CVE-2008-2291

axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 generates credentials with a fixed salt or without any salt, which makes it easier for remote attackers to guess encrypted domain credentials...

CVE-2008-2286

CVE-2008-2286 describes an SQL injection in Symantec Altiris Deployment Solution (DS) via axengine.exe, affecting 6.8.x and 6.9.x before 6.9.176. The vulnerability allows remote execution of arbitrary SQL commands through crafted notification packets (Port 402/tcp), with network access and no aut...

CVE-2008-2289: Undefined Security Weakness

Unspecified vulnerability in a tooltip element in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allows local users to gain privileges via unknown attack vectors...

CVE-2008-2288: Undefined Security Weakness

Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 has insufficient access control for deletion and modification of registry keys, which allows local users to cause a denial of service or obtain sensitive information...

CVE-2008-2287: Undefined Security Weakness

Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 does not properly protect the install directory, which might allow local users to gain privileges by replacing an application component with a Trojan horse...

CVE-2008-2290: Undefined Security Weakness

Unspecified vulnerability in the Agent user interface in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allows local users to gain privileges via unknown attack vectors...

CVE-2008-2291: Undefined Security Weakness

axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 generates credentials with a fixed salt or without any salt, which makes it easier for remote attackers to guess encrypted domain credentials...

CVE-2008-2286: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allows remote attackers to execute arbitrary SQL commands via unspecified string fields in a notification packet...

Symantec Altiris Deployment Solution多个安全漏洞

BUGTRAQ ID: 29198,29199,29194,29218,29196,29197 Symantec Altiris Deployment Solution是自动化的操作系统部署解决方案，用于从统一的位置部署和管理服务器、桌面和笔记本等。 Symantec Altiris Deployment Solution中存在多个安全漏洞，可能允许恶意的本地或远程用户获得权限提升、操控某些数据、泄露敏感信息、执行SQL注入攻击或入侵有漏洞的系统。 1 默认监听于TCP...

ZDI-08-024: Symantec Altiris Deployment Solution SQL Injection Vulnerability

ZDI-08-024: Symantec Altiris Deployment Solution SQL Injection Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-024 May 15, 2008 -- Affected Vendors: Symantec -- Affected Products: Symantec Altiris Deployment Solution -- TippingPointTM IPS Customer Protection: TippingPoint IPS...

ZDI-08-025: Symantec Altiris Deployment Solution Domain Credential Disclosure Vulnerability

ZDI-08-025: Symantec Altiris Deployment Solution Domain Credential Disclosure Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-025 May 15, 2008 -- Affected Vendors: Symantec -- Affected Products: Symantec Altiris Deployment Solution -- TippingPointTM IPS Customer Protection:...

Symantec Altiris Deployment Solution Domain Credential Disclosure Vulnerability

This vulnerability allows attackers to remotely obtain domain credentials on vulnerable installations of Symantec Altiris Deployment Solution. User interaction is not required to exploit this vulnerability. Authentication is not required to exploit this vulnerability. The specific flaw exists...

Symantec Altiris Deployment Solution SQL Injection Vulnerability

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Symantec Altiris Deployment Solution. User interaction is not required to exploit this vulnerability. The specific flaw exists within the axengine.exe process listening by default on TCP port 402. A lack ...

Altiris Deployment Solution < 6.9.176 Multiple Vulnerabilities

The version of the Altiris Deployment Solution installed on the remote host reportedly is affected by several issues : - A SQL injection vulnerability that could allow a user to run arbitrary code CVE-2008-2286. - A remote attacker may be able to obtain encrypted Altiris Deployment Solution domai...

Altiris Deployment Solution Agent < 6.9.176 Multiple Local Vulnerabilities

The version of the Altiris Deployment Solution Agent installed on the remote host reportedly is affected by several issues : - A local user could access a privileged command prompt via the Agent's user interface CVE-2008-2290. - A local user could leverage a GUI tooltip to access a privileged...

Symantec Altiris Deployment Solution AClient口令泄露漏洞

BUGTRAQ ID: 28707 Symantec Altiris Deployment Solution是自动化的操作系统部署解决方案，用于从统一的位置部署和管理服务器、桌面和笔记本等。 Symantec Altiris Deployment Solution的AClient.exe进程在内存中以明文存储AClient口令，恶意的本地用户可以通过dump AClient.exe进程内存检索本地代理管理接口的口令。 Symantec Altiris Deployment Solution 6.8.x Symantec --------...

CVE-2008-1754

Symantec Altiris Deployment Solution before 6.9.164 stores the Deployment Solution Agent aka AClient password in cleartext in memory, which allows local users to obtain sensitive information by dumping the AClient.exe process memory...

Design/Logic Flaw

Symantec Altiris Deployment Solution before 6.9.164 stores the Deployment Solution Agent aka AClient password in cleartext in memory, which allows local users to obtain sensitive information by dumping the AClient.exe process memory...