PT-2009-1239 · Symantec · Symantec Appstream Client

Published 2009-01-20 · Updated 2009-05-18 · CVE-2008-4388

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec AppStream Client versions prior to 5.2.2 SP3 MP1

Description The issue is related to the LaunchObj ActiveX control in the launcher.dll component, which does not properly validate downloaded files. This allows remote attackers to execute arbitrary code via the installAppMgr method and other unspecified methods.

Recommendations For Symantec AppStream Client versions prior to 5.2.2 SP3 MP1, update to version 5.2.2 SP3 MP1 or later to resolve the issue. As a temporary workaround, consider restricting access to the installAppMgr method and other vulnerable methods in the LaunchObj ActiveX control until a patch is applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-4388

Affected Products

Symantec Appstream Client

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/symantec_appstream_unsafe.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16512 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4388 · Security Note
• http://symantec.com/avcenter/security/Content/2009.01.15.html · Vendor Advisory
• http://securityfocus.com/bid/33247 · Note
• http://securitytracker.com/id?1021609 · Note
• http://kb.cert.org/vuls/id/194505 · Note