Vulnerabilities > CVE-2009-3031 - Buffer Errors vulnerability in Symantec products

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
symantec
CWE-119
critical
nessus
exploit available
metasploit
NVD
Published: 2009-11-03
Updated: 2018-10-10

Summary

Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control 6.0.0.1846 in AeXNSConsoleUtilities.dll in Symantec Altiris Notification Server (NS) 6.0 before R12, Deployment Server 6.8 and 6.9 in Symantec Altiris Deployment Solution 6.9 SP3, and Symantec Management Platform (SMP) 7.0 before SP3 allows remote attackers to execute arbitrary code via a long string in the second argument.

Vulnerable Configurations

Part Description Count
Application
Symantec
13

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Exploit-Db

  • descriptionSymantec ConsoleUtilities ActiveX Buffer Overflow. CVE-2009-3031. Remote exploit for windows platform
    idEDB-ID:9853
    last seen2016-02-01
    modified2009-11-02
    published2009-11-02
    reporterNikolas Sotiriu
    sourcehttps://www.exploit-db.com/download/9853/
    titleSymantec ConsoleUtilities ActiveX Buffer Overflow
  • descriptionSymantec ConsoleUtilities ActiveX Control Buffer Overflow. CVE-2009-3031. Remote exploit for windows platform
    idEDB-ID:16613
    last seen2016-02-02
    modified2010-11-11
    published2010-11-11
    reportermetasploit
    sourcehttps://www.exploit-db.com/download/16613/
    titleSymantec ConsoleUtilities ActiveX Control Buffer Overflow

Metasploit

descriptionThis module exploits a stack buffer overflow in Symantecs ConsoleUtilities. By sending an overly long string to the "BrowseAndSaveFile()" method located in the AeXNSConsoleUtilities.dll (6.0.0.1846) Control, an attacker may be able to execute arbitrary code
idMSF:EXPLOIT/WINDOWS/BROWSER/SYMANTEC_CONSOLEUTILITIES_BROWSEANDSAVEFILE
last seen2020-03-17
modified2017-07-24
published2009-11-02
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/browser/symantec_consoleutilities_browseandsavefile.rb
titleSymantec ConsoleUtilities ActiveX Control Buffer Overflow

Nessus

NASL familyWindows
NASL idALTIRIS_AEXNSCONSOLEUTILITIES_ACTIVEX.NASL
descriptionA vulnerable version of the Altiris ConsoleUtilities ActiveX control is installed on the remote host. This control comes with Altiris Deployment Solution, Altiris Notification Server, and Symantec Management Platform. There is a stack-based buffer overflow in the
last seen2020-06-01
modified2020-06-02
plugin id42372
published2009-11-04
reporterThis script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/42372
titleAltiris ConsoleUtilities 'BrowseAndSaveFile()' ActiveX Control Buffer Overflow

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/82425/symantec_consoleutilities_browseandsavefile.rb.txt
idPACKETSTORM:82425
last seen2016-12-05
published2009-11-03
reporterNikolas Sotiriu
sourcehttps://packetstormsecurity.com/files/82425/Symantec-ConsoleUtilities-ActiveX-Control-Metasploit-Exploit.html
titleSymantec ConsoleUtilities ActiveX Control Metasploit Exploit

Saint

bid36698
descriptionSymantec Multiple Products AeXNSConsoleUtilities Buffer Overflow
osvdb59597
titlesymantec_aexnsconsoleutilitiesdll
typeclient

Seebug

  • bulletinFamilyexploit
    descriptionBugraq ID: 36698 CVE ID：CVE-2009-3031 Symantec Altiris Deployment Solution是自动化的操作系统部署解决方案，用于从统一的位置部署和管理服务器、桌面和笔记本等。 在初次访问Altiris Deployment Solution等产品管理服务器的管理WEB站点时会安装一个ActiveX控件(AeXNSConsoleUtilities.dll)，此函数"BrowseAndSaveFile"存在一个基于栈的缓冲区溢出： Name: ConsoleUtilities Class Vendor: Altiris, Inc. Type: ActiveX-Steuerelement Version: 6.0.0.1846 GUID: {B44D252D-98FC-4D5C-948C-BE868392A004} File: AeXNSConsoleUtilities.dll Folder: C:\WINDOWS\system32 提交超长的字符串作为"BrowseAndSaveFile"函数的参数，可触发基于栈的缓冲区溢出，攻击者构建恶意WEB页，诱使用户解析可以应用程序权限执行任意指令。 Altiris Deployment Solution 6.x Altiris Notification Server 6.x Symantec Altiris ConsoleUtilities ActiveX Control 6.x Symantec Management Platform 7.x 用户可参考如下供应商提供的升级程序： 、Symantec Altiris Deployment Solution 6.9 SP1 Symantec AltirisNSConsole.zip https://kb.altiris.com/utility/getfile.asp?rid=6364&aid=49568 Symantec Altiris Deployment Solution 6.9 Symantec AltirisNSConsole.zip https://kb.altiris.com/utility/getfile.asp?rid=6364&aid=49568 Symantec Altiris Deployment Solution 6.9 SP3 Build 430 Symantec AltirisNSConsole.zip https://kb.altiris.com/utility/getfile.asp?rid=6364&aid=49568 Symantec Altiris Deployment Solution 6.9.164 Symantec AltirisNSConsole.zip https://kb.altiris.com/utility/getfile.asp?rid=6364&aid=49568 Symantec Altiris Deployment Solution 6.9.176 Symantec AltirisNSConsole.zip https://kb.altiris.com/utility/getfile.asp?rid=6364&aid=49568 Symantec Altiris Deployment Solution 6.9.355 Symantec AltirisNSConsole.zip https://kb.altiris.com/utility/getfile.asp?rid=6364&aid=49568 Symantec Altiris Deployment Solution 6.9.355 SP1 Symantec AltirisNSConsole.zip https://kb.altiris.com/utility/getfile.asp?rid=6364&aid=49568
    idSSV:12580
    last seen2017-11-19
    modified2009-11-05
    published2009-11-05
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-12580
    titleSymantec Altiris ConsoleUtilities ActiveX控件缓冲区溢出漏洞
  • bulletinFamilyexploit
    descriptionBUGTRAQ ID: 36698 CVE ID: CVE-2009-3031 Symantec Altiris Deployment Solution是自动化的操作系统部署解决方案，用于从统一的位置部署和管理服务器、桌面和笔记本等。 在初次连接到Altiris Deployment Solution等产品管理服务器的Web控制台时会安装一个AeXNSConsoleUtilities.dll ActiveX控件以授权到服务器的管理员访问，而该控件的BrowseAndSaveFile函数存在栈溢出漏洞。如果用户受骗访问了恶意网页并向该函数传送了超长参数的话，就可以触发这个溢出，导致执行任意指令。 Symantec Altiris Deployment Solution 6.9.x Symantec Altiris Notification Server 6.0.x Symantec Management Platform 7.0.x 临时解决方法： * 为clsid B44D252D-98FC-4D5C-948C-BE868392A004设置kill-bit。 厂商补丁： Symantec -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： https://kb.altiris.com/article.asp?article=49568&p=1 https://kb.altiris.com/article.asp?article=49389&p=1
    idSSV:12571
    last seen2017-11-19
    modified2009-11-03
    published2009-11-03
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-12571
    titleSymantec Altiris产品ConsoleUtilities ActiveX控件栈溢出漏洞

References