Symantec Altiris Deployment Solution Clear Text Password Local Information Disclosure Vulnerability

Bugtraq ID:	31767
Class:	Design Error
CVE:	CVE-2008-6828
Remote:	No
Local:	Yes
Published:	Oct 20 2008 12:00AM
Updated:	Apr 16 2015 05:52PM
Credit:	Mazin Faour of Information Risk Management Plc.
Vulnerable:	Symantec Altiris Deployment Solution 6.9.176 Symantec Altiris Deployment Solution 6.9.164 Symantec Altiris Deployment Solution 6.9
Not Vulnerable:	Symantec Altiris Deployment Solution 6.9.355

Symantec Altiris Deployment Solution Clear Text Password Local Information Disclosure Vulnerability

Symantec Altiris Deployment Solution is prone to a local information-disclosure vulnerability.

Local attackers can exploit this issue to obtain sensitive information that may allow attackers to perform unauthorized modification to computers on the affected network.

Versions prior to Symantec Altiris Deployment Solution 6.9.355 are vulnerable.

Symantec Altiris Deployment Solution Clear Text Password Local Information Disclosure Vulnerability

An attacker can use readily available utilities to exploit this issue.

Symantec Altiris Deployment Solution Clear Text Password Local Information Disclosure Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.

Symantec Altiris Deployment Solution Clear Text Password Local Information Disclosure Vulnerability

References:

• Altiris Deployment Solution Homepage (Symantec)
  
• SYM08-020 Symantec Altiris Deployment Solution Elevation of Privilege Clear Text (Symantec)