PT-2009-3933 · Symantec · Symantec Alert Management System 2+8

Sebastian Apelt · Published 2009-04-29 · Updated 2018-10-10 · CVE-2009-1430

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec Alert Management System 2 (AMS2) versions prior to the fixed version Symantec System Center (SSS) versions prior to the fixed version Symantec AntiVirus Server versions prior to the fixed version Symantec AntiVirus Central Quarantine Server versions prior to the fixed version Symantec AntiVirus (SAV) Corporate Edition versions prior to 9.0 MR7 Symantec AntiVirus (SAV) Corporate Edition 10.0 and 10.1 versions prior to 10.1 MR8 Symantec AntiVirus (SAV) Corporate Edition 10.2 versions prior to 10.2 MR2 Symantec Client Security (SCS) 2 versions prior to 2.0 MR7 Symantec Client Security (SCS) 3 versions prior to 3.1 MR8 Symantec Endpoint Protection (SEP) versions prior to 11.0 MR3

Description The issue is related to multiple stack-based buffer overflows in IAO.EXE, part of the Intel Alert Originator Service in Symantec Alert Management System 2 (AMS2). This allows remote attackers to execute arbitrary code via a crafted packet or data that ostensibly arrives from the MsgSys.exe process.

Recommendations For Symantec Alert Management System 2 (AMS2), update to the latest version to resolve the issue. For Symantec System Center (SSS), update to the latest version to resolve the issue. For Symantec AntiVirus Server, update to the latest version to resolve the issue. For Symantec AntiVirus Central Quarantine Server, update to the latest version to resolve the issue. For Symantec AntiVirus (SAV) Corporate Edition 9, update to 9.0 MR7 or later to resolve the issue. For Symantec AntiVirus (SAV) Corporate Edition 10.0 and 10.1, update to 10.1 MR8 or later to resolve the issue. For Symantec AntiVirus (SAV) Corporate Edition 10.2, update to 10.2 MR2 or later to resolve the issue. For Symantec Client Security (SCS) 2, update to 2.0 MR7 or later to resolve the issue. For Symantec Client Security (SCS) 3, update to 3.1 MR8 or later to resolve the issue. For Symantec Endpoint Protection (SEP), update to 11.0 MR3 or later to resolve the issue.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-1430

Affected Products

Symantec Alert Management System 2

Symantec Antivirus

Symantec Antivirus Central Quarantine Server

Symantec Antivirus Server

Symantec Antivirus Corporate Edition

Symantec Client Security

Symantec Endpoint Protection

Symantec Endpoint Protection Client

Symantec System Center

References · 18

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/antivirus/symantec_iao.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16826 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1430 · Security Note
• http://vupen.com/english/advisories/2009/1204 · Note
• http://securityfocus.com/archive/1/503080/100/0/threaded · Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_02 · Note
• http://securityfocus.com/bid/34674 · Note
• http://securityfocus.com/bid/34672 · Note
• http://securitytracker.com/id?1022131 · Note
• http://zerodayinitiative.com/advisories/ZDI-09-018 · Note
• http://xforce.iss.net/xforce/xfdb/50177 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50178 · Note
• http://xforce.iss.net/xforce/xfdb/50178 · Note
• http://securitytracker.com/id?1022132 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1430 · Note