PT-2010-1281 · Symantec+1 · Symantec Altiris Notification Server+1

Publicado 2010-02-02 · Atualizado 2017-08-17 · CVE-2009-3035

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:L/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec Altiris Notification Server versions 6.0.x through 6.0 before SP3 R12

Description The issue concerns the web console in Symantec Altiris Notification Server, which uses a hardcoded key to decrypt SQL Server credentials and certain discovery credentials. This key is stored on the Notification Server machine, allowing local users to obtain sensitive information. Potentially, this could also enable local users to execute arbitrary code by decrypting and using these credentials.

Recommendations For Symantec Altiris Notification Server versions 6.0.x through 6.0 before SP3 R12, update to Symantec Altiris Notification Server 6.0 SP3 R12 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2009-3035

Produtos afetados

Sql Server

Symantec Altiris Notification Server

Referências · 8

• http://securityfocus.com/bid/37953 · Nota
• http://securitytracker.com/id?1023521 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55952 · Nota
• http://osvdb.org/62010 · Nota
• http://vupen.com/english/advisories/2010/0256 · Nota
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20100128_00 · Nota
• http://secunia.com/advisories/38356 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-3035 · Nota de Segurança