Signature Detail

APP: Symantec Alert Management System Intel File Transfer Service Arbitrary Program Execution

This signature detects attempts to exploit a known vulnerability against Symantec Alert Management System. A successful exploitation will lead to arbitrary code execution or arbitrary files being executed within the context of System on the Windows platform.

Extended Description

Multiple Symantec products are prone to a remote code-execution vulnerability. Successfully exploiting this issue will allow an attacker to execute arbitrary code with SYSTEM-level privileges, completely compromising affected computers. Failed exploit attempts will result in a denial-of-service condition.

Affected Products

• Symantec AntiVirus Corporate Edition 10.0.0.359
• Symantec AntiVirus Corporate Edition 10.0.1.1000
• Symantec AntiVirus Corporate Edition 10.0.1.1001 (MR1-PP1)
• Symantec AntiVirus Corporate Edition 10.0.1.1003 (MR1-PP2)
• Symantec AntiVirus Corporate Edition 10.0.1.1007
• Symantec AntiVirus Corporate Edition 10.0.1.1008
• Symantec AntiVirus Corporate Edition 10.0.1.1009 (MR1-PP9)
• Symantec AntiVirus Corporate Edition 10.0.2.2000
• Symantec AntiVirus Corporate Edition 10.0.2 .2001
• Symantec AntiVirus Corporate Edition 10.0.2.2002
• Symantec AntiVirus Corporate Edition 10.0.2.2010
• Symantec AntiVirus Corporate Edition 10.0.2.2011
• Symantec AntiVirus Corporate Edition 10.0.2.2020
• Symantec AntiVirus Corporate Edition 10.0.2.2021
• Symantec AntiVirus Corporate Edition 10.1
• Symantec AntiVirus Corporate Edition 10.1.0.394
• Symantec AntiVirus Corporate Edition 10.1.0.396
• Symantec AntiVirus Corporate Edition 10.1.0.400
• Symantec AntiVirus Corporate Edition 10.1.0.401
• Symantec AntiVirus Corporate Edition 10.1.4
• Symantec AntiVirus Corporate Edition 10.1.4.4000 (MR4)
• Symantec AntiVirus Corporate Edition 10.1.4.4010
• Symantec AntiVirus Corporate Edition 10.1.4 MR4 MP1 - build 4010
• Symantec AntiVirus Corporate Edition 10.1.5.5000 (MR5)
• Symantec AntiVirus Corporate Edition 10.1.5.5001 (MR5-PP1)
• Symantec AntiVirus Corporate Edition 10.1.5.5010 (MR5-MP1)
• Symantec AntiVirus Corporate Edition 10.1.6.6000
• Symantec AntiVirus Corporate Edition 10.1.6.6010 (MR6-MP1)
• Symantec AntiVirus Corporate Edition 10.1.7.7000 (MR7)
• Symantec AntiVirus Corporate Edition 10.1 MR6
• Symantec AntiVirus Corporate Edition 10.1 MR6 MP1
• Symantec AntiVirus Corporate Edition 10.1 MR7
• Symantec AntiVirus Corporate Edition 10.2
• Symantec AntiVirus Corporate Edition 10.2.0.276 (STM 32-Bit)
• Symantec AntiVirus Corporate Edition 10.2.0.298 (STM 64-Bit)
• Symantec AntiVirus Corporate Edition 10.2.0.313 (STM-PP1)
• Symantec AntiVirus Corporate Edition 10.2.1.1000 (MR1)
• Symantec AntiVirus Corporate Edition 10.2 MR1
• Symantec AntiVirus Corporate Edition 9.0.0 .0.338
• Symantec AntiVirus Corporate Edition 9.0.0.1300 (STM-PP1)
• Symantec AntiVirus Corporate Edition 9.0.0.1400 (STM-PP2)
• Symantec AntiVirus Corporate Edition 9.0.1.1000 (MR1)
• Symantec AntiVirus Corporate Edition 9.0.1.1001 (MR1-PP1)
• Symantec AntiVirus Corporate Edition 9.0.1.1100 (MR1-MP1)
• Symantec AntiVirus Corporate Edition 9.0.2 .1000
• Symantec AntiVirus Corporate Edition 9.0.3 .1000
• Symantec AntiVirus Corporate Edition 9.0.3.1100 (MR3-MP1)
• Symantec AntiVirus Corporate Edition 9.0.4
• Symantec AntiVirus Corporate Edition 9.0.4 MR4 build 1000
• Symantec AntiVirus Corporate Edition 9.0.5
• Symantec AntiVirus Corporate Edition 9.0.5.1000 (MR5)
• Symantec AntiVirus Corporate Edition 9.0.5.1001 (MR5-PP1)
• Symantec AntiVirus Corporate Edition 9.0.5.1100
• Symantec AntiVirus Corporate Edition 9.0.6.1000
• Symantec AntiVirus Corporate Edition 9.0.6.1000 (MR6)
• Symantec AntiVirus Corporate Edition 9.0.6 MR6 MP1 - build 1100
• Symantec AntiVirus Corporate Edition 9 MR6 MP1
• Symantec Client Security 2.0.0.1300 (STM-PP1)
• Symantec Client Security 2.0.0.1400 (STM-PP2)
• Symantec Client Security 2.0.0.338 (STM)
• Symantec Client Security 2.0.1.1000 (MR1)
• Symantec Client Security 2.0.1.1001 (MR1-PP1)
• Symantec Client Security 2.0.1.1100 (MR1-MP1)
• Symantec Client Security 2.0.2.1000 (MR2)
• Symantec Client Security 2.0.3.1000 (MR3)
• Symantec Client Security 2.0.3.1100 (MR3-MP1)
• Symantec Client Security 2.0.4
• Symantec Client Security 2.0.4 MR4 build 1000
• Symantec Client Security 2.0.5.1000 (MR5)
• Symantec Client Security 2.0.5.1001 (MR5-PP1)
• Symantec Client Security 2.0.5 build 1100
• Symantec Client Security 2.0.6.1000 (MR6)
• Symantec Client Security 2.0.6 MR6
• Symantec Client Security 2.0.6 MR6 MP1 - build 1100
• Symantec Client Security 3.0.0.359
• Symantec Client Security 3.0.1.1000
• Symantec Client Security 3.0.1.1001
• Symantec Client Security 3.0.1.1003 (MR1-PP2)
• Symantec Client Security 3.0.1.1007
• Symantec Client Security 3.0.1.1008
• Symantec Client Security 3.0.1.1009 (MR1-PP9)
• Symantec Client Security 3.0.2.2000
• Symantec Client Security 3.0.2.2001
• Symantec Client Security 3.0.2.2002
• Symantec Client Security 3.0.2.2010
• Symantec Client Security 3.0.2.2011
• Symantec Client Security 3.0.2.2020
• Symantec Client Security 3.0.2.2021
• Symantec Client Security 3.1
• Symantec Client Security 3.1.0.394
• Symantec Client Security 3.1.0.396
• Symantec Client Security 3.1.0.400
• Symantec Client Security 3.1.0.401
• Symantec Client Security 3.1.4.4000 (MR4)
• Symantec Client Security 3.1.4 MR4 MP1 - build 4010
• Symantec Client Security 3.1.5.5000 (MR5)
• Symantec Client Security 3.1.5.5001 (MR5-PP1)
• Symantec Client Security 3.1.5.5010 (MR5-MP1)
• Symantec Client Security 3.1.6.6000
• Symantec Client Security 3.1.6.6010 (MR6-MP1)
• Symantec Client Security 3.1.7.7000 (MR7)
• Symantec Client Security 3.1 MR6
• Symantec Client Security 3.1 MR6 MP1
• Symantec Client Security 3.1 MR7
• Symantec Endpoint Protection 11.0.1000.1375 (MR1)
• Symantec Endpoint Protection 11.0.1002.1378 (MR1-PP2)
• Symantec Endpoint Protection 11.0.1005.1428 (MR1-PP5)
• Symantec Endpoint Protection 11.0.2000.1567 (MR2)
• Symantec Endpoint Protection 11.0.2001.10 (MR2-PP1)
• Symantec Endpoint Protection 11.0.2010.25 (MR2-MP1)
• Symantec Endpoint Protection 11.0.2020.56 (MR2-MP2)
• Symantec Endpoint Protection 11.0.780.1109 (STM)
• Symantec Endpoint Protection 11.0.781.1287 (STM-PP1)

References

• BugTraq: 34675
• CVE: CVE-2009-1431