PT-2005-2569 · Symantec · Altiris Client Service

Published 2005-05-16 · Updated 2008-09-05 · CVE-2005-1590

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Altiris Client Service for Windows version 6.0.88

Description The issue allows local users to bypass password protection and access the administrative interface. This can be achieved by finding and showing the hidden "Altiris Client Service" window, then disabling password protection and the "Hide client tray icon box" option. Afterwards, users can open the AClient tray icon and use the View Log File option to gain unauthorized access.

Recommendations For version 6.0.88, consider restricting access to the administrative interface until a fix is available. As a temporary workaround, disable the View Log File option in the AClient tray icon to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2005-1590

Affected Products

Altiris Client Service

References · 5

• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2005-04/0614.html · Exploit
• 🔥 https://exploit-db.com/exploits/24754 · Exploit
• 🔥 http://osvdb.org/15897 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1590 · Security Note
• http://secunia.com/advisories/15159 · Vendor Advisory