Login Request a demo
Unscored severity · published Feb 2, 2010
CVE-2009-3035
The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded key that can decrypt SQL Server credentials and certain discovery credentials,…
–
CVSS
0.4%
EPSS
No
On KEV
Description
The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded key that can decrypt SQL Server credentials and certain discovery credentials, and stores this key on the Notification Server machine, which allows local users to obtain sensitive information and possibly execute arbitrary code by decrypting and using these credentials.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Altiris Notification Server · Symantec
6.0; 6.0; 6.0; 6.0; 6.0; 6.0 · source: NVD
Affected product
AN
Altiris Notification Server
Symantec
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3035
osvdb.org
http://osvdb.org/62010
Vendor Advisory
http://secunia.com/advisories/38356
www.securityfocus.com
http://www.securityfocus.com/bid/37953
www.securitytracker.com
http://www.securitytracker.com/id?1023521
www.symantec.com
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20100128_00
www.vupen.com
http://www.vupen.com/english/advisories/2010/0256
More from Altiris Notification Server
–
CVE-2009-3028
The Altiris eXpress NS SC Download ActiveX control in AeXNSPkgDLLib.dll, as used in Symantec Altiris Deployment Solution 6.9.x, Notification Server 6.0.x, and Symantec Management…
–
CVE-2009-3033
Buffer overflow in the RunCmd method in the Altiris eXpress NS Console Utilities ActiveX control in AeXNSConsoleUtilities.dll in the web console in Symantec Altiris Deployment…
–
CVE-2009-3031
Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control 6.0.0.1846 in AeXNSConsoleUtilities.dll in Symantec Altiris…
–
CVE-2008-2794
Unspecified vulnerability in the GUI in Symantec Altiris Notification Server Agent 6.x before 6.0 SP3 R8 allows local users to gain privileges via unknown attack vectors
–
CVE-2008-0716
The agent in Symantec Altiris Notification Server before 6.0 SP3 R7 allows local users to gain privileges via a "Shatter" style attack