CVE-2008-1754
First published: Fri Apr 11 2008(Updated: )
Symantec Altiris Deployment Solution before 6.9.164 stores the Deployment Solution Agent (aka AClient) password in cleartext in memory, which allows local users to obtain sensitive information by dumping the AClient.exe process memory.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Broadcom Symantec Deployment Solutions | <=6.8 | |
| Broadcom Symantec Deployment Solutions | =6.8-sp1 | |
| Broadcom Symantec Deployment Solutions | =6.8.380 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://securityresponse.symantec.com/avcenter/security/Content/2008.04.10.html
- http://www.securityfocus.com/bid/28707
- http://www.securitytracker.com/id?1019825
- http://secunia.com/advisories/29771
- http://www.osvdb.org/44388
- http://www.vupen.com/english/advisories/2008/1197/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41771
Frequently Asked Questions
What is the severity of CVE-2008-1754?
CVE-2008-1754 is considered a medium severity vulnerability due to the potential for local users to access sensitive information.
How do I fix CVE-2008-1754?
To fix CVE-2008-1754, upgrade to Symantec Altiris Deployment Solution version 6.9.164 or later, which addresses the issue.
What type of vulnerability is CVE-2008-1754?
CVE-2008-1754 is a local information disclosure vulnerability due to the storage of passwords in cleartext in memory.
Which versions of Symantec Altiris Deployment Solution are affected by CVE-2008-1754?
CVE-2008-1754 affects versions 6.8, 6.8-SP1, and 6.8.380 of Symantec Altiris Deployment Solution.
What can attackers achieve by exploiting CVE-2008-1754?
Attackers can obtain sensitive Deployment Solution Agent passwords by dumping the memory of the AClient.exe process.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/symantec
- canonical/broadcom symantec deployment solutions
- version/broadcom symantec deployment solutions/6.8
- version/broadcom symantec deployment solutions/6.8-sp1
- version/broadcom symantec deployment solutions/6.8.380