CVE-2008-6827

Published: Jun 8, 2009Modified: Apr 23, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack on the "command prompt" hidden GUI button to (1) overwrite the CommandLine parameter to cmd.exe to use SYSTEM privileges and (2) modify the DLL that is loaded using the LoadLibrary API function.

Affected (2)

Products: Symantec: Altiris Deployment Solution

1 product

Altiris Deployment Solution

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Symantec Altiris Deployment Solution	From 6.0 to 6.9.355
Symantec Altiris Deployment Solution	Version 6.9.355

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (18)

http://marc.info/?l=bugtraq&m=122460544316205&w=2

Source: cve@mitre.org

Mailing List

http://osvdb.org/49426

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/31773

Source: cve@mitre.org

Broken LinkVendor Advisory

http://www.insomniasec.com/advisories/ISVA-081020.1.htm

Source: cve@mitre.org

Broken LinkPatch

http://www.securityfocus.com/bid/31766

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1021071

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.symantec.com/avcenter/security/Content/2008.10.20a.html

Source: cve@mitre.org

Broken LinkPatchVendor Advisory

http://www.vupen.com/english/advisories/2008/2876

Source: cve@mitre.org

Broken LinkPatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/46006

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://marc.info/?l=bugtraq&m=122460544316205&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://osvdb.org/49426

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://secunia.com/advisories/31773

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkVendor Advisory

http://www.insomniasec.com/advisories/ISVA-081020.1.htm

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkPatch

http://www.securityfocus.com/bid/31766

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1021071

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

http://www.symantec.com/avcenter/security/Content/2008.10.20a.html

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkPatchVendor Advisory

http://www.vupen.com/english/advisories/2008/2876

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkPatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/46006

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.