PT-2010-1281 · Symantec+1 · Symantec Altiris Notification Server+1

Published 2010-02-02 · Updated 2017-08-17 · CVE-2009-3035

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec Altiris Notification Server versions 6.0.x through 6.0 before SP3 R12

Description The issue concerns the web console in Symantec Altiris Notification Server, which uses a hardcoded key to decrypt SQL Server credentials and certain discovery credentials. This key is stored on the Notification Server machine, allowing local users to obtain sensitive information. Potentially, this could also enable local users to execute arbitrary code by decrypting and using these credentials.

Recommendations For Symantec Altiris Notification Server versions 6.0.x through 6.0 before SP3 R12, update to Symantec Altiris Notification Server 6.0 SP3 R12 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2009-3035

Affected Products

Sql Server

Symantec Altiris Notification Server

References · 8

• http://secunia.com/advisories/38356 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-3035 · Security Note
• http://securityfocus.com/bid/37953 · Note
• http://securitytracker.com/id?1023521 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55952 · Note
• http://osvdb.org/62010 · Note
• http://vupen.com/english/advisories/2010/0256 · Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20100128_00 · Note