CVE-2009-2570

CVE-2009-2570: A stack-based buffer overflow in the Symantec.FaxViewerControl.1 ActiveX control (WinFax\DCCFAXVW.DLL) in Symantec WinFax Pro 10.03 allows remote attackers to execute arbitrary code via a long argument to the AppendFax method. The connected Nessus/NASL entries confirm the affected ...

CVE-2009-2570

Stack-based buffer overflow in the Symantec.FaxViewerControl.1 ActiveX control in WinFax\DCCFAXVW.DLL in Symantec WinFax Pro 10.03 allows remote attackers to execute arbitrary code via a long argument to the AppendFax method...

多个Symantec产品RAR/TAR/ZIP文件扫描绕过漏洞

Bugraq ID: 35354 多个Symantec产品对畸形或特殊格式的压缩档文件如tar/zip/rar/缺少真确处理，可导致绕过扫描产品的检测。 攻击者构建恶意的文件，发送给目标用户，可绕过检测使应用程序展开并执行。 目前没有详细漏洞细节提供。 Symantec Symantec AntiVirus Scan Engine for Microsoft ISA 4.3.12 Symantec Symantec AntiVirus Corporate Edition 10.2 MR2 Symantec Scan Engine 5.1.6.31 Symantec Scan Engine...

Specifically Crafted Archive/Container Files can Bypass Initial Scans

SUMMARY Specifically-crafted archive and container files can potentially bypass initial malware scans in some products. AFFECTED PRODUCTS Products --- Symantec Mail Security for Domino Symantec Mail Security for Microsoft Exchange Symantec Mail Security for SMTP Symantec Brightmail Gateway Symant...

Design/Logic Flaw

Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 stores the Application Identity Account password in memory in cleartext, which allows local users to gain privileges and modify clients of the Deployment Solution Server...

Command injection

The ListView control in the Client GUI AClient.exe in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack on the "command prompt" hidden GUI button to 1 overwrite the CommandLine...

CVE-2008-6827

The ListView control in the Client GUI AClient.exe in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack on the "command prompt" hidden GUI button to 1 overwrite the CommandLine...

CVE-2008-6828

Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 stores the Application Identity Account password in memory in cleartext, which allows local users to gain privileges and modify clients of the Deployment Solution Server...

CVE-2008-6827

The ListView control in the Client GUI AClient.exe in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack on the "command prompt" hidden GUI button to 1 overwrite the CommandLine...

CVE-2008-6828

CVE-2008-6828 affects Symantec Altiris Deployment Solution (6.x) prior to 6.9.355 SP1. Affected component: Application Identity Account handling; root cause: the Application Identity Account password is stored in memory in cleartext, enabling a local attacker to glean credentials and gain privile...

CVE-2008-6828

Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 stores the Application Identity Account password in memory in cleartext, which allows local users to gain privileges and modify clients of the Deployment Solution Server...

CVE-2008-6827

Affected software: Symantec Altiris Deployment Solution (Client GUI) with AClient.exe in 6.x before 6.9.355 SP1. Vulnerability: A local privilege escalation via the ListView control’s hidden GUI button (the “Shatter” style attack) allows overwriting the CommandLine parameter to cmd.exe to gain SY...

PT-2009-2296 · Symantec +1 · Symantec Altiris Deployment Solution +1

Name of the Vulnerable Software and Affected Versions: Symantec Altiris Deployment Solution versions prior to 6.9.355 SP1 Description: The issue allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack. This attack targets the CommandLine parameter ...

Staying safe online: The need for cybersecurity

On the day that President Obama releases a cybersecurity policy review, hear from experts and officials in the field. This video features Janet Napolitano, Secretary of Homeland Security; William Pelgrin, Chief Cybersecurity Officer of New York; John Thompson, CEO of Symantec; Leslie Harris of th...

BlackBerry附件服务PDF处理器多个未明安全漏洞

Bugraq ID: 35102 CNCAN ID：CNCAN-2009052702 BlackBerry企业服务器的BlackBerry附件服务组件处理恶意PDF文件时存在多个安全问题，远程攻击者可以利用漏洞以应用服务进程权限执行任意指令，或导致拒绝服务攻击。 攻击者可以通过发送包含特殊构建的PDF文件的EMAIL消息来触发，目前没有详细漏洞细节提供。 Symantec Clientless VPN Gateway 4400 Series 4.0 SP3 Symantec Clientless VPN Gateway 4400 Series 4.0 SP2 Symantec...

Symantec Alert Management System File Transfer Service Remote Code Execution (CVE-2009-1431)

Symantec System Center provides centralized systems and policy management for Norton Antivirus Enterprise Solution across multiple Windows NT and NetWare networks. The vulnerability is due to a design error in the Intel File Transfer service XFR.EXE, a service used to aid communication between th...

Symantec Alert Management System Alert Originator Service Buffer Overflow (CVE-2009-1430)

Symantec System Center provides centralized systems and policy management for Norton Antivirus Enterprise Solution across multiple Windows NT and NetWare networks. The vulnerability exists in the IAO Service of Symantec Alert Management System 2 AMS2. The vulnerability is due to a boundary error ...

Symantec Norton Ghost Symantec.EasySetup.1 ActiveX控件拒绝服务漏洞

BUGTRAQ ID: 34696 CVECAN ID: CVE-2009-1517 Symantec Norton Ghost是一个备份恢复系统，允许用户将系统恢复到之前的快照状态。 Norton Ghost的EasySetup安装向导的EasySetupInt.dll库提供了名为Symantec.EasySetup.1的ActiveX控件，该控件没有正确地验证对GetBackupLocationPath、CallUninstall、SetupDeleteVolume、...

Symantec Alert Management System Intel File Transfer service command execution

Added: 05/06/2009 CVE: CVE-2009-1431 BID: 34675 OSVDB: 54160 Background The Symantec Alert Management System 2 AMS2 is used by multiple Symantec products. The Intel File Transfer service is a component of AMS2 which is used to aid communication between the core server and managed clients. It...

Symantec Alert Management System Intel File Transfer service command execution

Added: 05/06/2009 CVE: CVE-2009-1431 BID: 34675 OSVDB: 54160 Background The Symantec Alert Management System 2 AMS2 is used by multiple Symantec products. The Intel File Transfer service is a component of AMS2 which is used to aid communication between the core server and managed clients. It...