CVE-2008-4389

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-06-17 · updated 2026-06-16
Weakness: CWE-287

Description

Symantec AppStream 5.2.x and Symantec Workspace Streaming (SWS) 6.1.x before 6.1 SP4 do not properly perform authentication, which allows remote Workspace Streaming servers and man-in-the-middle attackers to download arbitrary executable files onto a client system, and execute these files, via unspecified vectors.

Affected products

Symantec Appstream: 5.2, 5.2.1, 5.2.2, 5.2.3
Symantec Workspace Streaming: 6.1, 6.1-sp1, 6.1-sp2, 6.1-sp3

References

http://secunia.com/advisories/40233
http://www.kb.cert.org/vuls/id/221257
http://www.securityfocus.com/bid/40611
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20100616_00
http://www.vupen.com/english/advisories/2010/1511
https://exchange.xforce.ibmcloud.com/vulnerabilities/59504
http://secunia.com/advisories/40233
http://www.kb.cert.org/vuls/id/221257
http://www.securityfocus.com/bid/40611
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20100616_00
http://www.vupen.com/english/advisories/2010/1511
https://exchange.xforce.ibmcloud.com/vulnerabilities/59504

Get alerted when CVE-2008-4389 or the next vulnerability affects your stack