Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 does not properly restrict access to the listening port for the DBManager service, which allows remote attackers to bypass authentication and modify tasks or the Altiris Database via a connection to this service.

Threat-Mapped Scoring

Score: 0.0

Priority: Unclassified

EPSS

Score: 0.00238
Percentile: 0.46821

CVSS Scoring

Mapped CWE(s)

• CWE-287 : Improper Authentication

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1548 : Abuse Elevation Control Mechanism
  Kill Chain: privilege-escalation
• T1548 : Abuse Elevation Control Mechanism
  Kill Chain: privilege-escalation
• T1040 : Network Sniffing
  Kill Chain: credential-access
• T1185 : Browser Session Hijacking
  Kill Chain: collection
• T1550.001 : Application Access Token
  Kill Chain: defense-evasion
• T1563 : Remote Service Session Hijacking
  Kill Chain: lateral-movement
• T1134 : Access Token Manipulation
  Kill Chain: defense-evasion
• T1505.003 : Web Shell
  Kill Chain: persistence
• T1557 : Adversary-in-the-Middle
  Kill Chain: credential-access

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:symantec:altiris_deployment_solution:6.9:*:*:*:*:*:*:*
• cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp1:*:*:*:*:*:*
• cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp2:*:*:*:*:*:*

← Back to Home