CVE-2009-3107
CVE-2009-3107 is a medium-severity vulnerability in Symantec Altiris Deployment Solution with a CVSS 2.0 base score of 4.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-287.
Key facts
- Severity: Medium (CVSS 2.0 base score 4.8)
- EPSS exploit prediction: 1% (57th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-287
- Affected product: Symantec Altiris Deployment Solution
- Published:
- Last modified:
Description
Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 does not properly restrict access to the listening port for the DBManager service, which allows remote attackers to bypass authentication and modify tasks or the Altiris Database via a connection to this service.
Frequently asked questions
- What is CVE-2009-3107?
- Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 does not properly restrict access to the listening port for the DBManager service, which allows remote attackers to bypass authentication and modify tasks or the Altiris Database via a connection to this service.
- How severe is CVE-2009-3107?
- CVE-2009-3107 has a CVSS 2.0 base score of 4.8, rated medium severity.
- Is CVE-2009-3107 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2009-3107?
- CVE-2009-3107 primarily affects Symantec Altiris Deployment Solution. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2009-3107?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2009-3107 published?
- CVE-2009-3107 was published on 2009-09-08 and last updated on 2026-06-16.
References
- http://secunia.com/advisories/36502
- http://www.securityfocus.com/bid/36110
- http://www.securitytracker.com/id?1022779
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090826_00
Affected products (3)
- cpe:2.3:a:symantec:altiris_deployment_solution:6.9:*:*:*:*:*:*:*
- cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp1:*:*:*:*:*:*
- cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp2:*:*:*:*:*:*
More vulnerabilities in Symantec Altiris Deployment Solution
- CVE-2009-3179 — Critical (CVSS 10.0): Multiple unspecified vulnerabilities in Symantec Altiris Deployment Solution 6.9 might allow remote attackers to…
- CVE-2009-3033 — Critical (CVSS 9.3): Buffer overflow in the RunCmd method in the Altiris eXpress NS Console Utilities ActiveX control in…
- CVE-2009-3031 — Critical (CVSS 9.3): Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control…
- CVE-2009-3109 — Critical (CVSS 9.3): Unspecified vulnerability in the AClient agent in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430,…
- CVE-2008-4564 — Critical (CVSS 9.3): Stack-based buffer overflow in wp6sr.dll in the Autonomy KeyView SDK 10.4 and earlier, as used in IBM Lotus Notes,…
- CVE-2009-3178 — High (CVSS 7.8): Unspecified vulnerability in mm.exe in Symantec Altiris Deployment Solution 6.9 allows remote attackers to cause a…
All CVEs affecting Symantec Altiris Deployment Solution →
Other CWE-287 (Improper Authentication) vulnerabilities
- CVE-2026-45480 — Critical (CVSS 10.0): Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-46389 — Critical (CVSS 10.0): UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS…
- CVE-2026-10611 — Critical (CVSS 10.0): An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement.…
- CVE-2026-47280 — Critical (CVSS 10.0): Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a…
- CVE-2026-42822 — Critical (CVSS 10.0): Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges…
- CVE-2026-20182 — Critical (CVSS 10.0): May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and…
Browse all CWE-287 (Improper Authentication) vulnerabilities →