Altiris Deployment Server allows unauthorized access
| altiris-gain-unauth-access (17814) |  Medium Risk |
Description:
Altiris Deployment Server could allow a remote attacker to gain unauthorized administrative access. The AClient.exe process fails to properly request authentication from the Deployment Server when establishing a connection to the server. A remote attacker, in control of a malicious Deployment Server, could exploit this vulnerability to gain administrative access to the Altiris clients within the network.
Consequences:
Gain Access
Remedy:
No remedy available as of February 6, 2010.
References:
- Altiris Deployment Server Web page: Altiris Deployment Solution.
- BugTraq Mailing List, Mon Oct 25 2004 - 14:46:52 CDT: RE: Critical Vulnerability in Altiris Deployment Server architecture.
- BugTraq Mailing List, Thu Oct 21 2004 - 08:12:44 CDT : Critical Vulnerability in Altiris Deployment Server architecture.
- BID-11498: Altiris Deployment Server Remote Command Execution Vulnerability
- CVE-2004-2622: AClient.exe in Altiris Deployment Solution 6.x and 5.x does not require authentication from the first Deployment Server that it connects to, which allows remote malicious servers to gain administrator access.
- OSVDB ID: 11031: Altiris Deployment Solution AClient.exe Unauthenticated Remote Access
- SA12944: Altiris Deployment Solution Missing Server Authentication Security Issue
- SECTRACK ID: 1011862: Altiris Deployment Server Client Authentication Hole Lets Remote Users Gain Full Control of the Client
Platforms Affected:
- Altiris Deployment Server 5.0.1
- Altiris Deployment Server 5.5
- Altiris Deployment Server 6.0
- Altiris Deployment Server 6.1 SP1
- Altiris Deployment Server 6.1
Reported:
Oct 21, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net