Login Request a demo
High severity · published Jun 8, 2009
CVE-2008-6828
Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 stores the Application Identity Account password in memory in cleartext, which allows local users to gain privileges…
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 stores the Application Identity Account password in memory in cleartext, which allows local users to gain privileges and modify clients of the Deployment Solution Server.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Altiris Deployment Solution · Symantec
before 6.9.355; 6.9.355 · source: NVD
Affected product
AD
Altiris Deployment Solution
Symantec
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6828
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6828
Broken Link
http://secunia.com/advisories/31773
Broken Link
http://securityresponse.symantec.com/avcenter/security/Content/2008.10.20b.html
Broken Link
http://www.securityfocus.com/bid/31767
Broken Link
http://www.securitytracker.com/id?1021072
Broken Link
http://www.vupen.com/english/advisories/2008/2876
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/46007
More from Altiris Deployment Solution
7.8
CVE-2008-6827
The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute…
6.5
CVE-2010-0109
DBManager in Symantec Altiris Deployment Solution 6.9.x before DS 6.9 SP4 allows remote attackers to cause a denial of service via a crafted request
–
CVE-2009-3028
The Altiris eXpress NS SC Download ActiveX control in AeXNSPkgDLLib.dll, as used in Symantec Altiris Deployment Solution 6.9.x, Notification Server 6.0.x, and Symantec Management…
–
CVE-2009-3033
Buffer overflow in the RunCmd method in the Altiris eXpress NS Console Utilities ActiveX control in AeXNSConsoleUtilities.dll in the web console in Symantec Altiris Deployment…
–
CVE-2009-3031
Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control 6.0.0.1846 in AeXNSConsoleUtilities.dll in Symantec Altiris…