CVE-2009-3028

Published: Mar 7, 2011Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

The Altiris eXpress NS SC Download ActiveX control in AeXNSPkgDLLib.dll, as used in Symantec Altiris Deployment Solution 6.9.x, Notification Server 6.0.x, and Symantec Management Platform 7.0.x exposes an unsafe method, which allows remote attackers to force the download of arbitrary files and possibly execute arbitrary code via the DownloadAndInstall method.

Affected (30)

Products: Symantec: Altiris Deployment Solution, Altiris Notification Server, Management Platform

Symantec

3 products

Altiris Deployment Solution

Altiris Notification Server

Management Platform

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Symantec Altiris Deployment Solution	Version 6.9
Symantec Altiris Deployment Solution	Version 6.9 sp1
Symantec Altiris Deployment Solution	Version 6.9 sp2
Symantec Altiris Deployment Solution	Version 6.9 sp3
Symantec Altiris Deployment Solution	Version 6.9 sp4

Configuration B

18 vulnerable

Vulnerable Software	Affected Versions
Symantec Altiris Notification Server	Version 6.0
Symantec Altiris Notification Server	Version 6.0 sp1
Symantec Altiris Notification Server	Version 6.0 sp1_hf12
Symantec Altiris Notification Server	Version 6.0 sp2
Symantec Altiris Notification Server	Version 6.0 sp3
Symantec Altiris Notification Server	Version 6.0 sp3_r10
Symantec Altiris Notification Server	Version 6.0 sp3_r11
Symantec Altiris Notification Server	Version 6.0 sp3_r12
Symantec Altiris Notification Server	Version 6.0 sp3_r13
Symantec Altiris Notification Server	Version 6.0 sp3_r1
Symantec Altiris Notification Server	Version 6.0 sp3_r2
Symantec Altiris Notification Server	Version 6.0 sp3_r3
Symantec Altiris Notification Server	Version 6.0 sp3_r4
Symantec Altiris Notification Server	Version 6.0 sp3_r5
Symantec Altiris Notification Server	Version 6.0 sp3_r6
Symantec Altiris Notification Server	Version 6.0 sp3_r7
Symantec Altiris Notification Server	Version 6.0 sp3_r8
Symantec Altiris Notification Server	Version 6.0 sp3_r9

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Symantec Management Platform	Version 7.0
Symantec Management Platform	Version 7.0 rc5
Symantec Management Platform	Version 7.0 sp1
Symantec Management Platform	Version 7.0 sp2
Symantec Management Platform	Version 7.0 sp3
Symantec Management Platform	Version 7.0 sp4
Symantec Management Platform	Version 7.0 sp5