PT-2011-1303 · Symantec · Symantec Management Platform+2

Published 2011-03-07 · Updated 2013-02-07 · CVE-2009-3028

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec Altiris Deployment Solution versions 6.9.x Symantec Notification Server versions 6.0.x Symantec Management Platform versions 7.0.x

Description The issue concerns an unsafe method exposed by the Altiris eXpress NS SC Download ActiveX control in AeXNSPkgDLLib.dll. This allows remote attackers to force the download of arbitrary files and possibly execute arbitrary code via the DownloadAndInstall method.

Recommendations For Symantec Altiris Deployment Solution versions 6.9.x, consider disabling the DownloadAndInstall method until a patch is available. For Symantec Notification Server versions 6.0.x, restrict access to the AeXNSPkgDLLib.dll library to minimize the risk of exploitation. For Symantec Management Platform versions 7.0.x, avoid using the DownloadAndInstall method in the affected ActiveX control until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2009-3028

Affected Products

Symantec Altiris Deployment Solution

Symantec Management Platform

Symantec Notification Server

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/symantec_altirisdeployment_downloadandinstall.rb · Exploit
• 🔥 http://securityfocus.com/bid/36346 · Exploit
• 🔥 https://exploit-db.com/exploits/16600 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3028 · Security Note
• http://secunia.com/advisories/36679 · Vendor Advisory
• http://symantec.com/business/support/index?page=content&id=TECH44885 · Patch
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090922_00 · Note
• http://osvdb.org/57893 · Note