CVSS: 9.3EPSS: 95%CPEs: 13EXPL: 4CVE-2009-3031 – Symantec ConsoleUtilities - ActiveX Buffer Overflow
https://notcve.org/view.php?id=CVE-2009-3031
Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control 6.0.0.1846 in AeXNSConsoleUtilities.dll in Symantec Altiris Notification Server (NS) 6.0 before R12, Deployment Server 6.8 and 6.9 in Symantec Altiris Deployment Solution 6.9 SP3, and Symantec Management Platform (SMP) 7.0 before SP3 allows remote attackers to execute arbitrary code via a long string in the second argument. Desbordamiento de búfer basado en pila en el método BrowseAndSaveFile en el control ActiveX ConsoleUtilities v6.0.0.1846 en AeXNSConsoleUtilities.dll en Symantec Altiris Notification Server (NS) v6.0 anterior a R12, Deployment Server 6.8 and 6.9 in Symantec Altiris Deployment Solution v6.9 SP3, y Symantec Management Platform (SMP) v7.0 anterior a SP3, permite a atacantes remotos ejecutar código de su elección a través de una cadena larga en el segundo argumento. • https://www.exploit-db.com/exploits/9853 https://www.exploit-db.com/exploits/16613 http://sotiriu.de/adv/NSOADV-2009-001.txt http://www.securityfocus.com/archive/1/507625/100/0/threaded http://www.securityfocus.com/bid/36698 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20091102_00 http://www.vupen.com/english/advisories/2009/3117 https://kb.altiris.com/article.asp?article=49389&p=1 https://kb& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2009-3179
https://notcve.org/view.php?id=CVE-2009-3179
Multiple unspecified vulnerabilities in Symantec Altiris Deployment Solution 6.9 might allow remote attackers to execute arbitrary code via unknown client-side attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.17, as identified by (1) "Symantec Altiris Deployment Solution 6.9 exploit, (2) "Symantec Altiris Deployment Solution 6.9 exploit (II)," and (3) "Symantec Altiris Deployment Solution 6.9 exploit (III)." NOTE: as of 20090909, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. Múltiples vulnerabilidades no especificadas en Symantec Altiris Deployment Solution v6.9, podrían permitir a atacantes remotos ejecutar código de su elección a través de vectores de ataque del lado del cliente, como se demostró por un módulo concreto en VulnDisco Pack Professional v7.17, como se identificó por (1) exploit "Symantec Altiris Deployment Solution v6.9, (2) exploit "Symantec Altiris Deployment Solution v6.9 (II)," y (3) exploit "Symantec Altiris Deployment Solution v6.9 (III)." NOTA, como en 20090909, de esta información no se tiene información de la acción. • http://intevydis.com/vd-list.shtml http://secunia.com/advisories/36587 http://www.securityfocus.com/bid/36247 •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2009-3178
https://notcve.org/view.php?id=CVE-2009-3178
Unspecified vulnerability in mm.exe in Symantec Altiris Deployment Solution 6.9 allows remote attackers to cause a denial of service via unknown attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 7.18, "Symantec Altiris Deployment Solution 6.9 DoS." NOTE: as of 20090909, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. Vulnerabilidad no específica en mm.exe en Symantec Altiris Deployment Solution v6.9, permite a atacantes remotos provocar una denegación de servicio a través de vectores de ataque desconocidos, como se demostró por un módulo concreto en VulnDisco Pack Professional v7.18, " Symantec Altiris Deployment Solution 6.9 DoS". NOTA, como en 20090909, de esta información no se tiene información de la acción. • http://intevydis.com/vd-list.shtml http://secunia.com/advisories/36587 http://www.securityfocus.com/bid/36247 •
CVSS: 5.8EPSS: 0%CPEs: 6EXPL: 0CVE-2009-3110
https://notcve.org/view.php?id=CVE-2009-3110
Race condition in the file transfer functionality in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 allows remote attackers to read sensitive files and prevent client updates by connecting to the file transfer port before the expected client does. Condición de carrera en la funcionalidad de transferencia de ficheros en Symantec Altiris Deployment Solution v6.9.x anterior a v6.9 SP3 Build 430, permite a atacantes remotos leer archivos sensibles y prevenir las actualizaciones de los clientes mediante la conexión a un puerto de transferencia antes de que lo haga el autentico cliente. • http://secunia.com/advisories/36502 http://www.securityfocus.com/bid/36113 http://www.securitytracker.com/id?1022779 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090826_00 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2009-3108
https://notcve.org/view.php?id=CVE-2009-3108
The Aclient GUI in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 installs a client executable with insecure permissions (Everyone:Full Control), which allows local users to gain privileges by replacing the executable with a Trojan horse program. Aclient GUI en Symantec Altiris Deployment Solution v6.9.x anterior v6.9 SP3 Build 430 instala un cliente ejecutable con permisos no seguros (todos: control total), que permite a usuarios locales obtener privilegios y reemplazar el ejecutable con un programa troyano. • http://secunia.com/advisories/36502 http://www.securityfocus.com/bid/36111 http://www.securitytracker.com/id?1022779 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090826_00 • CWE-264: Permissions, Privileges, and Access Controls •