PT-2013-5329 · Symantec · Altiris+1

Published 2013-10-10 · Updated 2013-10-10 · CVE-2013-5008

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec Management Platform versions 7.0 through 7.1 before 7.1 SP2 Mp1.1v7 rollup

Description The issue allows local users to obtain sensitive information or cause a denial of service by exploiting the use of the same registry-entry encryption key across different customers' installations. This affects the agent and task-agent components in certain Altiris products.

Recommendations For Symantec Management Platform versions 7.0 through 7.1 before 7.1 SP2 Mp1.1v7 rollup, update to version 7.1 SP2 Mp1.1v7 rollup or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-5008

Affected Products

Altiris

Symantec Management Platform

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-5008 · Security Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20131008_00 · Vendor Advisory
• http://securityfocus.com/bid/62757 · Note