PT-2009-5368 · Symantec · Symantec Management Platform+2

Nikolas Sotiriu · Published 2009-11-03 · Updated 2018-10-10 · CVE-2009-3031

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Symantec Altiris Notification Server (NS) versions 6.0.0.1846 through 6.0 before R12 Symantec Altiris Deployment Solution versions 6.8 and 6.9 in Deployment Server Symantec Management Platform (SMP) versions 7.0 through 7.0 before SP3

Description: The issue is a stack-based buffer overflow in the BrowseAndSaveFile method within the Altiris eXpress NS ConsoleUtilities ActiveX control. This allows remote attackers to execute arbitrary code via a long string in the second argument to the BrowseAndSaveFile method.

Recommendations: For Symantec Altiris Notification Server (NS) versions 6.0.0.1846 through 6.0 before R12, update to R12 or later. For Symantec Altiris Deployment Solution versions 6.8 and 6.9 in Deployment Server, consider disabling the BrowseAndSaveFile method until a patch is available. For Symantec Management Platform (SMP) versions 7.0 through 7.0 before SP3, update to SP3 or later.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-3031

Affected Products

Symantec Altiris Deployment Solution

Symantec Altiris Notification Server

Symantec Management Platform

References · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/symantec_consoleutilities_browseandsavefile.rb · Exploit
• 🔥 http://securityfocus.com/bid/36698 · Exploit
• 🔥 https://exploit-db.com/exploits/9853 · Exploit
• 🔥 https://exploit-db.com/exploits/16613 · Exploit
• 🔥 http://sotiriu.de/adv/NSOADV-2009-001.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3031 · Security Note
• https://kb.altiris.com/article.asp?article=49389&p=1 · Vendor Advisory
• http://vupen.com/english/advisories/2009/3117 · Vendor Advisory
• https://kb.altiris.com/article.asp?article=49568&p=1 · Vendor Advisory
• http://securityfocus.com/archive/1/507625/100/0/threaded · Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20091102_00 · Note