CVE-2009-3108

The Aclient GUI in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 installs a client executable with insecure permissions (Everyone:Full Control), which allows local users to gain privileges by replacing the executable with a Trojan horse program.

Published: Sep 9, 2009
Updated: Apr 13, 2023
CVE: CVE-2009-3108
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 7.2
AV:L/AC:L/Au:N/C:C/I:C/A:C

CWEs:

CWE-264

Affected Software
References

Software	From	Fixed in
symantec / altiris_deployment_solution	6.9	6.9.x
symantec / altiris_deployment_solution	6.9-sp1	6.9-sp1.x
symantec / altiris_deployment_solution	6.9.164	6.9.164.x
symantec / altiris_deployment_solution	6.9.176	6.9.176.x
symantec / altiris_deployment_solution	6.9.355-sp1	6.9.355-sp1.x
symantec / altiris_deployment_solution	6.9.355	6.9.355.x

http://secunia.com/advisories/36502
http://www.securityfocus.com/bid/36111
http://www.securitytracker.com/id?1022779
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090826_00

Vulnerability Database

290,206

CVE-2009-3108