Symantec Altiris Deployment Solution Domain Credential Unauthorized Access Vulnerability

Bugtraq ID:	29199
Class:	Design Error
CVE:	CVE-2008-2291
Remote:	Yes
Local:	No
Published:	May 14 2008 12:00AM
Updated:	May 07 2015 05:28PM
Credit:	Brett Moore of Insomnia Security, working through Zero Day Initiative.
Vulnerable:	Symantec Altiris Deployment Solution 6.9.164 Symantec Altiris Deployment Solution 6.9 Symantec Altiris Deployment Solution 6.8.380.0 Symantec Altiris Deployment Solution 6.8 SP2 Symantec Altiris Deployment Solution 6.8 SP1 Symantec Altiris Deployment Solution 6.8 HP ProLiant Essentials Rapid Deployment Pack (RDP) 0
Not Vulnerable:	Symantec Altiris Deployment Solution 6.9.176

Symantec Altiris Deployment Solution Domain Credential Unauthorized Access Vulnerability

Symantec Altiris Deployment Solution is prone to a vulnerability that allows an attacker to gain unauthorized access to the affected application.

The attacker can exploit this issue to gain administrative access to the application. Successfully exploiting this issue will compromise the affected application.

Symantec Altiris Deployment Solution Domain Credential Unauthorized Access Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Symantec Altiris Deployment Solution Domain Credential Unauthorized Access Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.

Symantec Altiris Deployment Solution Domain Credential Unauthorized Access Vulnerability

References:

• Altiris Deployment Solution Homepage (Symantec)
  
• Insomnia : ISVA-080516.2 - Altiris Deployment Solution - Domain Account Disclosu ("Brett Moore" )
  
• SYM008-012 Altiris Deployment Solution Multiple Vulnerabilities (Symantec)
  
• ZDI-08-025: Symantec Altiris Deployment Solution Domain Credential Disclosure Vu (Zero Day Initiative)