CVE-2009-3108

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-09-08 · updated 2026-06-16
Weakness: CWE-264

Description

The Aclient GUI in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 installs a client executable with insecure permissions (Everyone:Full Control), which allows local users to gain privileges by replacing the executable with a Trojan horse program.

Affected products

Symantec Altiris Deployment Solution: 6.9, 6.9-sp1, 6.9.164, 6.9.176, 6.9.355, 6.9.355-sp1

References

http://secunia.com/advisories/36502
http://www.securityfocus.com/bid/36111
http://www.securitytracker.com/id?1022779
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090826_00
http://secunia.com/advisories/36502
http://www.securityfocus.com/bid/36111
http://www.securitytracker.com/id?1022779
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090826_00

Get alerted when CVE-2009-3108 or the next vulnerability affects your stack