CVE-2008-2286

Related Files

Symantec Altiris DS SQL Injection

Posted Nov 9, 2013

Authored by Brett Moore, 3v0lver | Site metasploit.com

This Metasploit module exploits a SQL injection flaw in Symantec Altiris Deployment Solution 6.8 to 6.9.164. The vulnerability exists on axengine.exe which fails to adequately sanitize numeric input fields in "UpdateComputer" notification Requests. In order to spawn a shell, several SQL injections are required in close succession, first to enable xp_cmdshell, then retrieve the payload via TFTP and finally execute it. The module also has the capability to disable or enable local application authentication. In order to work the target system must have a tftp client available.

tags | exploit, shell, local, sql injection

advisories | CVE-2008-2286, OSVDB-45313

SHA-256 | 0e3a942ab280498a695c23461a8d0a229e06c84edd64ed4f0b821529fe187516

Download | Favorite | View

HP Security Bulletin 2008-01.15

Posted Sep 17, 2008

Authored by Hewlett Packard | Site hp.com

HP Security Bulletin - Potential vulnerabilities have been identified with HP ProLiant Essentials Rapid Deployment Pack (RDP) running Symantec Altiris Deployment Solution. The vulnerabilities could be exploited remotely to perform SQL injection or to gain extended privileges. The vulnerabilities could be exploited locally to gain extended privileges or to cause a Denial of Service (DoS).

tags | advisory, denial of service, vulnerability, sql injection

advisories | CVE-2008-2286, CVE-2008-2287, CVE-2008-2288, CVE-2008-2289, CVE-2008-2290, CVE-2008-2291

SHA-256 | be4e2da79288ccc406599b1da3d57c11778c5b81433e88411811be65d2670afb

Download | Favorite | View