Unscored severity · published Nov 25, 2009
CVE-2009-3033
Buffer overflow in the RunCmd method in the Altiris eXpress NS Console Utilities ActiveX control in AeXNSConsoleUtilities.dll in the web console in Symantec Altiris Deployment…
–
CVSS
40%
EPSS
No
On KEV
Description
Buffer overflow in the RunCmd method in the Altiris eXpress NS Console Utilities ActiveX control in AeXNSConsoleUtilities.dll in the web console in Symantec Altiris Deployment Solution 6.9.x, Altiris Notification Server 6.0.x, and Management Platform 7.0.x allows remote attackers to execute arbitrary code via a long string in the second argument.
Exploitation
Is it being used?
Exploit prediction (EPSS)40.0% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Altiris Deployment Solution · Symantec
6.9; 6.9; 6.9; 6.9; 6.9.164; 6.9.176; +2 more · source: NVD
AM
Altiris Management Platform · Symantec
7.0; 7.0 · source: NVD
AN
Altiris Notification Server · Symantec
6.0; 6.0; 6.0; 6.0; 6.0; 6.0_sp3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3033
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3033
osvdb.org
http://osvdb.org/60496
Exploit
http://www.securityfocus.com/bid/37092
www.symantec.com
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20091124_00
Vendor Advisory
http://www.vupen.com/english/advisories/2009/3328
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/54415
kb.altiris.com
https://kb.altiris.com/article.asp?article=50072&p=1
More from Altiris Deployment Solution
7.8
CVE-2008-6828
Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 stores the Application Identity Account password in memory in cleartext, which allows local users to gain privileges…
7.8
CVE-2008-6827
The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute…
6.5
CVE-2010-0109
DBManager in Symantec Altiris Deployment Solution 6.9.x before DS 6.9 SP4 allows remote attackers to cause a denial of service via a crafted request
–
CVE-2009-3028
The Altiris eXpress NS SC Download ActiveX control in AeXNSPkgDLLib.dll, as used in Symantec Altiris Deployment Solution 6.9.x, Notification Server 6.0.x, and Symantec Management…
–
CVE-2009-3031
Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control 6.0.0.1846 in AeXNSConsoleUtilities.dll in Symantec Altiris…