Symantec Altiris Notification Server Static Encryption Key Unauthorized Access Vulnerability

Bugtraq ID:	37953
Class:	Design Error
CVE:	CVE-2009-3035
Remote:	Yes
Local:	No
Published:	Jan 28 2010 12:00AM
Updated:	Jan 28 2010 12:00AM
Credit:	Matthew Burnett
Vulnerable:	Symantec Altiris Notification Server 6.8 SP3 R8 Symantec Altiris Notification Server 6.0 SP3 R7 Symantec Altiris Notification Server 6.0 SP3 Symantec Altiris Notification Server 6.0 SP2 Symantec Altiris Notification Server 6.0 SP1 Symantec Altiris Notification Server 6.0
Not Vulnerable:	Symantec Management Platform 7.0 SP1 Symantec Management Platform 7.0 Symantec Altiris Notification Server 6.0 SP3 R12

Symantec Altiris Notification Server Static Encryption Key Unauthorized Access Vulnerability

Symantec Altiris Notification Server is prone to an unauthorized-access vulnerability.

An attacker may be able to access certain encrypted credentials and encryption keys. The attacker can then execute code, obtain sensitive information, or perform actions with elevated privileges. Other attacks may also be possible.

Symantec Altiris Notification Server Static Encryption Key Unauthorized Access Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Symantec Altiris Notification Server Static Encryption Key Unauthorized Access Vulnerability

Solution:
The vendor has released an update. Please see the references for details.

Symantec Altiris Notification Server Static Encryption Key Unauthorized Access Vulnerability

References:

• Symantec Homepage (Symantec)
  
• Security Advisories Relating to Symantec Products - Symantec Altiris Notificatio (Symantec)