Description
AClient.exe in Altiris Deployment Solution 6.x and 5.x does not require authentication from the first Deployment Server that it connects to, which allows remote malicious servers to gain administrator access.
Affected products
- altiris / deployment_server_extension_for_ibm_director5.0.1 – 5.0.1
- altiris / deployment_server_extension_for_ibm_director5.5 – 5.5
- altiris / deployment_server_extension_for_ibm_director6.0 – 6.0
- altiris / deployment_server_extension_for_ibm_director6.1 – 6.1
- altiris / deployment_server_extension_for_ibm_director6.1 – 6.1
References
- MISChttp://www.securityfocus.com/bid/11498
- MISChttp://www.osvdb.org/11031
- MISChttp://www.altiris.com/support/forum/Framesearch.aspx?vpath=/aexkb/public%20articles/6.x/deployment%20solution/kb/ds%20client%20security%20kb%20article%2010-22-04.doc&art=AKB6859&source=Altiris%20Helpdesk&artID=23644&refpara=532392&key=akb6859
- MISChttp://securitytracker.com/id?1011862
- MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/17814
- VENDOR_ADVISORYhttp://secunia.com/advisories/12944
- MISChttp://archives.neohapsis.com/archives/bugtraq/2004-10/0211.html
- MISChttp://archives.neohapsis.com/archives/bugtraq/2004-10/0266.html
- VENDOR_ADVISORYhttp://packetstorm.linuxsecurity.com/0410-advisories/index2.html