Description
AClient.exe in Altiris Deployment Solution 6.x and 5.x does not require authentication from the first Deployment Server that it connects to, which allows remote malicious servers to gain administrator access.
References
- 11498 vdb-entry
- 11031 vdb-entry
- http://www.altiris.com/support/forum/Framesearch.aspx?vpath=/aexkb/public%20articles/6.x/deployment%20solution/kb/ds%20client%20security%20kb%20article%2010-22-04.doc&art=AKB6859&source=Altiris%20Helpdesk&artID=23644&refpara=532392&key=akb6859
- 1011862 vdb-entry
- altiris-gain-unauth-access(17814) vdb-entry
- 12944 third-party-advisory
- 20041021 Critical Vulnerability in Altiris Deployment Server architecture mailing-list
- 20041025 RE: Critical Vulnerability in Altiris Deployment Server architecture mailing-list
- http://packetstorm.linuxsecurity.com/0410-advisories/index2.html