CVE-2009-1429 : The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2), as used in Symantec System Cente

The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2), as used in Symantec System Center (SSS); Symantec AntiVirus Server; Symantec AntiVirus Central Quarantine Server; Symantec AntiVirus (SAV) Corporate Edition 9 before 9.0 MR7, 10.0 and 10.1 before 10.1 MR8, and 10.2 before 10.2 MR2; Symantec Client Security (SCS) 2 before 2.0 MR7 and 3 before 3.1 MR8; and Symantec Endpoint Protection (SEP) before 11.0 MR3, allows remote attackers to execute arbitrary commands via a crafted packet whose contents are interpreted as a command to be launched in a new process by the CreateProcessA function.

Published 2009-04-29 15:30:00

Updated 2017-08-17 01:30:21

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2009-1429

EPSS FAQ

97.01%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2009-1429

Symantec System Center Alert Management System (xfr.exe) Arbitrary Command Execution

Disclosure Date: 2009-04-28

First seen: 2020-04-26

exploit/windows/antivirus/ams_xfr

Symantec System Center Alert Management System is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input. Authors: - MC <mc@metasploit.com>

More information

CVSS scores for CVE-2009-1429

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2009-1429

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2009-1429

http://www.securitytracker.com/id?1022131

CVEs referencing this url
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090428_02

CVEs referencing this url
http://www.vupen.com/english/advisories/2009/1204

Vendor Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/34671

Multiple Symantec Products Intel Common Base Agent Remote Command Execution Vulnerability
Exploit
http://securityreason.com/securityalert/8346
http://www.securitytracker.com/id?1022130

CVEs referencing this url
http://www.securitytracker.com/id?1022132

CVEs referencing this url
https://exchange.xforce.ibmcloud.com/vulnerabilities/50176

Products affected by CVE-2009-1429

Symantec » Client Security
Versions up to, including, (<=) 3.1
cpe:2.3:a:symantec:client_security:*:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 2.0
cpe:2.3:a:symantec:client_security:2.0:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 3.0
cpe:2.3:a:symantec:client_security:3.0:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 3.0.2.2010
cpe:2.3:a:symantec:client_security:3.0.2.2010:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 3.0.2.2020
cpe:2.3:a:symantec:client_security:3.0.2.2020:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 3.0.1.1001
cpe:2.3:a:symantec:client_security:3.0.1.1001:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 3.0.1.1007
cpe:2.3:a:symantec:client_security:3.0.1.1007:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 3.0.2.2021
cpe:2.3:a:symantec:client_security:3.0.2.2021:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 3.0.1.1008
cpe:2.3:a:symantec:client_security:3.0.1.1008:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 3.0.2.2000
cpe:2.3:a:symantec:client_security:3.0.2.2000:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 3.0.2.2001
cpe:2.3:a:symantec:client_security:3.0.2.2001:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 3.0.2.2002
cpe:2.3:a:symantec:client_security:3.0.2.2002:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 3.0.0.359
cpe:2.3:a:symantec:client_security:3.0.0.359:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 3.0.1.1000
cpe:2.3:a:symantec:client_security:3.0.1.1000:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 3.0.2.2011
cpe:2.3:a:symantec:client_security:3.0.2.2011:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 3.0.1.1009
cpe:2.3:a:symantec:client_security:3.0.1.1009:*:*:*:*:*:*:*
Matching versions
Symantec » Client Security » Version: 3.0.2
cpe:2.3:a:symantec:client_security:3.0.2:*:*:*:*:*:*:*
Matching versions
Symantec » Antivirus » Corporate Edition
Versions up to, including, (<=) 10.2
cpe:2.3:a:symantec:antivirus:*:*:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Corporate Edition
Versions up to, including, (<=) 9.0
cpe:2.3:a:symantec:antivirus:*:-:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Corporate Edition
Versions up to, including, (<=) 10.1
cpe:2.3:a:symantec:antivirus:*:*:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Version: 10.0.1 Corporate Edition
cpe:2.3:a:symantec:antivirus:10.0.1:*:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Version: 10.0.2 Corporate Edition
cpe:2.3:a:symantec:antivirus:10.0.2:*:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Version: 10.0.9 Corporate Edition
cpe:2.3:a:symantec:antivirus:10.0.9:*:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Version: 10.0.2.1 Corporate Edition
cpe:2.3:a:symantec:antivirus:10.0.2.1:*:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Version: 10.0.5 Corporate Edition
cpe:2.3:a:symantec:antivirus:10.0.5:*:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Version: 10.0.6 Corporate Edition
cpe:2.3:a:symantec:antivirus:10.0.6:*:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Version: 10.0 Corporate Edition
cpe:2.3:a:symantec:antivirus:10.0:*:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Version: 10.0.7 Corporate Edition
cpe:2.3:a:symantec:antivirus:10.0.7:*:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Version: 10.0.8 Corporate Edition
cpe:2.3:a:symantec:antivirus:10.0.8:*:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Version: 10.0.3 Corporate Edition
cpe:2.3:a:symantec:antivirus:10.0.3:*:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Version: 10.0.4 Corporate Edition
cpe:2.3:a:symantec:antivirus:10.0.4:*:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Version: 10.0.2.2 Corporate Edition
cpe:2.3:a:symantec:antivirus:10.0.2.2:*:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Version: 10.0.1.1 Corporate Edition
cpe:2.3:a:symantec:antivirus:10.0.1.1:*:corporate:*:*:*:*:*
Matching versions
Symantec » Antivirus » Version: N/A SRV Edition
cpe:2.3:a:symantec:antivirus:-:-:srv:*:*:*:*:*
Matching versions
Symantec » Endpoint Protection
Versions up to, including, (<=) 11.0
cpe:2.3:a:symantec:endpoint_protection:*:*:*:*:*:*:*:*
Matching versions
Symantec » System Center
cpe:2.3:a:symantec:system_center:*:*:*:*:*:*:*:*
Matching versions
Symantec » Antivirus Central Quarantine Server
cpe:2.3:a:symantec:antivirus_central_quarantine_server:*:*:*:*:*:*:*:*
Matching versions