Symantec Altiris Deployment Solution AClient Password Disclosure Vulnerability

Bugtraq ID:	28707
Class:	Design Error
CVE:	CVE-2008-1754
Remote:	No
Local:	Yes
Published:	Apr 10 2008 12:00AM
Updated:	May 07 2015 05:30PM
Credit:	Mazin Faour from Information Risk Management
Vulnerable:	Symantec Altiris Deployment Solution 6.8.380.0 Symantec Altiris Deployment Solution 6.8 SP2 Symantec Altiris Deployment Solution 6.8 SP1 Symantec Altiris Deployment Solution 6.8
Not Vulnerable:	Symantec Altiris Deployment Solution 6.9.164

Symantec Altiris Deployment Solution AClient Password Disclosure Vulnerability

Symantec Altiris Deployment Solution AClient is prone to a local password-disclosure vulnerability because of a design error.

Exploiting this issue may allow a local attacker to access unencrypted passwords, potentially allowing them to access the application's administrative interface in an unauthorized manner. This can facilitate a complete compromise of affected computers.

This issue affects versions prior to Altiris Deployment Solution 6.9.164.

Symantec Altiris Deployment Solution AClient Password Disclosure Vulnerability

An attacker can use readily available tools to exploit this issue.

Symantec Altiris Deployment Solution AClient Password Disclosure Vulnerability

Solution:
Symantec has released Altiris Deployment Solution 6.9.164 to address this issue. Please see the vendor references for information on obtaining and installing the fixed version.

Symantec Altiris Deployment Solution AClient Password Disclosure Vulnerability

References:

• Altiris Deployment Solution Homepage (Symantec)
  
• Symantec Altiris Homepage (Symantec)
  
• SYM08-011 Symantec Altiris Deployment Solution Clear Text Password (Symantec)