Vulnerability Details CVE-2009-3109
Unspecified vulnerability in the AClient agent in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430, when key-based authentication is being used between a deployment server and a client, allows remote attackers to bypass authentication and execute arbitrary commands as SYSTEM by spoofing the deployment server and sending "alternate commands" before the handshake is completed.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 58.6%
CVSS Severity
CVSS v2 Score 9.3
References
- http://secunia.com/advisories/36502
- http://www.securityfocus.com/bid/36112
- http://www.securitytracker.com/id?1022779
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090826_00
- http://secunia.com/advisories/36502
- http://www.securityfocus.com/bid/36112
- http://www.securitytracker.com/id?1022779
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090826_00
Products affected by CVE-2009-3109
-
cpe:2.3:a:symantec:altiris_deployment_solution:6.9