Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2009-3031

CWE-119 — Buffer Overflow6 documents5 sources
Severity
9.3CRITICAL
EPSS
76.6%
top 1.05%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Symantec Altiris Deployment SolutionSymantec Altiris Management PlatformSymantec Altiris Notification Server
Timeline
PublishedNov 3
Latest updateMay 2

Description

Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control 6.0.0.1846 in AeXNSConsoleUtilities.dll in Symantec Altiris Notification Server (NS) 6.0 before R12, Deployment Server 6.8 and 6.9 in Symantec Altiris Deployment Solution 6.9 SP3, and Symantec Management Platform (SMP) 7.0 before SP3 allows remote attackers to execute arbitrary code via a long string in the second argument.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages3 packages

Patches

Patch: www.securityfocus.com ↗Patch: www.vupen.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-fq54-rqwh-5q9h: Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control 6↗2022-05-02
▶
CVEList
CVE-2009-3031: Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control 6↗2009-11-03
▶

💥Exploits & PoCs

2
Exploit-DB
Symantec ConsoleUtilities - ActiveX Control Buffer Overflow (Metasploit)↗2010-11-11
▶
Exploit-DB
Symantec ConsoleUtilities - ActiveX Buffer Overflow (Metasploit)↗2009-11-02
▶

🔍Detection Rules

1
Suricata
ET ACTIVEX Multiple Altiris Products AeXNSConsoleUtilities.dll ActiveX Control BrowseAndSaveFile Method Buffer Overflow Attempt Function Call↗2010-07-30
▶
CVE-2009-3031 (CRITICAL CVSS 9.3) | Stack-based buffer overflow in the | cvebase.io