CVE-2008-2291 axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 generates credentials with a fixed salt or without any salt, which makes it easier for remote attackers to guess enc...
HighCVSS 7.5
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 generates credentials with a fixed salt or without any salt, which makes it easier for remote attackers to guess encrypted domain credentials.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| symantec altiris deployment solution | >= 6.9, < 6.9.176 | 6.9.176 |
| symantec altiris deployment solution | = 6.8 | No fix listed |
| symantec altiris deployment solution | = 6.8-sp1 | No fix listed |
| symantec altiris deployment solution | = 6.8-sp2 | No fix listed |
References
- SSRT080115 mailing-list third-party-advisory vendor-advisory
- 30261 third-party-advisory
- www.insomniasec.com third-party-advisory
- 20080515 ZDI-08-025: Symantec Altiris Deployment Solution Domain Credential Disclosure Vulnerability mailing-list third-party-advisory vdb-entry
- 20080518 Insomnia : ISVA-080516.2 - Altiris Deployment Solution - Domain Account Disclosure mailing-list third-party-advisory vdb-entry
- 29199 third-party-advisory vdb-entry
- 1020024 third-party-advisory vdb-entry
- www.symantec.com patch vendor-advisory
- ADV-2008-1542 third-party-advisory vdb-entry
- www.zerodayinitiative.com third-party-advisory vdb-entry
- symantec-altiris-axengine-info-disclosure(42437) third-party-advisory vdb-entry