Symantec Altiris Deployment Solution 'DBManager' Authentication Bypass Vulnerability
BID:36110
Info
Symantec Altiris Deployment Solution 'DBManager' Authentication Bypass Vulnerability
| Bugtraq ID: | 36110 |
| Class: | Access Validation Error |
| CVE: |
CVE-2009-3107 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 26 2009 12:00AM |
| Updated: | Jan 07 2010 05:32PM |
| Credit: | Luke Jennings with MWRInfosecurity |
| Vulnerable: |
Symantec Altiris Deployment Solution 6.9.355 SP1 Symantec Altiris Deployment Solution 6.9.355 Symantec Altiris Deployment Solution 6.9.176 Symantec Altiris Deployment Solution 6.9.164 Symantec Altiris Deployment Solution 6.9 SP1 Symantec Altiris Deployment Solution 6.9 |
| Not Vulnerable: |
Symantec Altiris Deployment Solution 6.9 SP3 Build 430 |
Discussion
Symantec Altiris Deployment Solution 'DBManager' Authentication Bypass Vulnerability
Symantec Altiris Deployment Solution is prone to a vulnerability that allows an attacker to bypass authentication and gain unauthorized access to the affected application.
Attackers with authorized network access can exploit this issue to bypass 'DBManager' authentication. Successful exploits may allow attackers to modify Altiris database data on the targeted computer.
Versions prior to Altiris Deployment Solution 6.9 SP3 Build 430 are vulnerable.
Symantec Altiris Deployment Solution is prone to a vulnerability that allows an attacker to bypass authentication and gain unauthorized access to the affected application.
Attackers with authorized network access can exploit this issue to bypass 'DBManager' authentication. Successful exploits may allow attackers to modify Altiris database data on the targeted computer.
Versions prior to Altiris Deployment Solution 6.9 SP3 Build 430 are vulnerable.
Exploit / POC
Symantec Altiris Deployment Solution 'DBManager' Authentication Bypass Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Symantec Altiris Deployment Solution 'DBManager' Authentication Bypass Vulnerability
Solution:
The vendor has released an update. Please see the references for details.
Solution:
The vendor has released an update. Please see the references for details.
References
Symantec Altiris Deployment Solution 'DBManager' Authentication Bypass Vulnerability
References:
References:
- Altiris Deployment Solution (Luke Jennings)
- Altiris Deployment Solution Homepage (Symantec)
- SYM09-011 Security Advisories Relating to Symantec Products - Symantec Altiris D (Symantec)
- Symantec�??s Altiris Deployment Solution �?? DBManager Authentication Bypass (MWR InfoSecurity)