Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
APP:SYMC:ALTIRIS-DS-SQL-INJ |
|---|---|
Severity |
Minor |
Recommended |
No |
Recommended Action |
Drop |
Category |
APP |
Keywords |
Symantec Altiris DS SQL Injection |
Release Date |
2014/03/07 |
Update Number |
2352 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
APP: Symantec Altiris DS SQL Injection
This signature detects attempts to exploit multiple SQL Injection vulnerability in Symantec Altiris. An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.
Extended Description
Symantec Altiris Deployment Solution is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to execute arbitrary code with SYSTEM-level privileges. Successfully exploiting this issue will facilitate in the complete compromise of affected computers. Versions prior to Symantec Altiris Deployment Solution 6.9.176 are vulnerable.
Affected Products
- Hp proliant_essentials_rapid_deployment_pack_(rdp)
- Symantec altiris_deployment_solution 6.8
- Symantec altiris_deployment_solution 6.8.380.0
- Symantec altiris_deployment_solution 6.8 SP1
- Symantec altiris_deployment_solution 6.8 SP2
- Symantec altiris_deployment_solution 6.9
- Symantec altiris_deployment_solution 6.9.164
References
- BugTraq: 29198
- CVE: CVE-2008-2286
- URL: http://www.zerodayinitiative.com/advisories/ZDI-08-024