VYPR
Get started
← All advisories
Unrated severityNVD Advisory· Published Feb 2, 2010· Updated Apr 29, 2026

CVE-2009-3035

CVE-2009-3035

Description

The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded key that can decrypt SQL Server credentials and certain discovery credentials, and stores this key on the Notification Server machine, which allows local users to obtain sensitive information and possibly execute arbitrary code by decrypting and using these credentials.

Affected products

6
  • Symantec/Altiris Notification Server6 versions
    cpe:2.3:a:symantec:altiris_notification_server:6.0:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:symantec:altiris_notification_server:6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:symantec:altiris_notification_server:6.0:sp1:*:*:*:*:*:*
    • cpe:2.3:a:symantec:altiris_notification_server:6.0:sp2:*:*:*:*:*:*
    • cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3:*:*:*:*:*:*
    • cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r7:*:*:*:*:*:*
    • cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r8:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.