CVE-2009-3028
Summary
| CVE | CVE-2009-3028 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2011-03-07 21:00:01 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The Altiris eXpress NS SC Download ActiveX control in AeXNSPkgDLLib.dll, as used in Symantec Altiris Deployment Solution 6.9.x, Notification Server 6.0.x, and Symantec Management Platform 7.0.x exposes an unsafe method, which allows remote attackers to force the download of arbitrary files and possibly execute arbitrary code via the DownloadAndInstall method. |
Risk And Classification
Primary CVSS: v2.0 6.8 from [email protected]
AV:N/AC:M/Au:N/C:P/I:P/A:P
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Symantec Altiris eXpress NS SC Download ActiveX Control Arbitrary File Download Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Exploit |
| Enterprise Support - Symantec Corp. - Vulnerability in the Altiris eXpress NS SC Download ActiveX control | af854a3a-2127-422b-91ae-364da2661108 | www.symantec.com | Patch |
| Altirix eXpress NS SC Download ActiveX Control "DownloadAndInstall()" Insecure Method - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| www.osvdb.org/57893 | af854a3a-2127-422b-91ae-364da2661108 | www.osvdb.org | |
| Broadcom Support Portal | af854a3a-2127-422b-91ae-364da2661108 | www.symantec.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.