PT-2004-3512 · Symantec · Altiris Deployment Solution

Published 2004-12-31 · Updated 2017-07-20 · CVE-2004-2622

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Altiris Deployment Solution versions 5.x through 6.x

Description The issue concerns a lack of required authentication in AClient.exe, allowing remote malicious servers to gain administrator access if they are the first Deployment Server that AClient.exe connects to.

Recommendations For Altiris Deployment Solution versions 5.x through 6.x, consider implementing additional authentication mechanisms to ensure that only authorized Deployment Servers can connect to AClient.exe. As a temporary workaround, restrict access to AClient.exe to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-2622

Affected Products

Altiris Deployment Solution

References · 10

• http://secunia.com/advisories/12944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2622 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2004-10/0211.html · Vendor Advisory
• http://securitytracker.com/id?1011862 · Vendor Advisory
• http://securityfocus.com/bid/11498 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17814 · Note
• http://packetstorm.linuxsecurity.com/0410-advisories/index2.html · Note
• http://altiris.com/support/forum/Framesearch.aspx?vpath=/aexkb/public%20articles/6.x/deployment%20solution/kb/ds%20client%20security%20kb%20article%2010-22-04.doc&art=AKB6859&source=Altiris%20Helpdesk&artID=23644&refpara=532392&key=akb6859 · Note
• http://archives.neohapsis.com/archives/bugtraq/2004-10/0266.html · Note
• http://osvdb.org/11031 · Note