Fuck you Tippingpoint fags. Go jump off a cliff. LOSERS! On Thu, May 15, 2008 at 1:25 PM, <[EMAIL PROTECTED]> wrote: > ZDI-08-025: Symantec Altiris Deployment Solution Domain Credential > Disclosure Vulnerability > http://www.zerodayinitiative.com/advisories/ZDI-08-025 > May 15, 2008 > > -- Affected Vendors: > Symantec > > -- Affected Products: > Symantec Altiris Deployment Solution > > -- TippingPoint(TM) IPS Customer Protection: > TippingPoint IPS customers have been protected against this > vulnerability by Digital Vaccine protection filter ID 5936. > For further product information on the TippingPoint IPS, visit: > > http://www.tippingpoint.com > > -- Vulnerability Details: > This vulnerability allows attackers to remotely obtain domain > credentials on vulnerable installations of Symantec Altiris Deployment > Solution. User > interaction is not required to exploit this vulnerability. > Authentication is not required to exploit this vulnerability. > > The specific flaw exists within the axengine.exe service listening by > default on TCP port 402. The service allows a remote client to request > encrypted domain credentials without authentication. The encryption > lacks a salt allowing an attacker with a local installation of Altiris > Deployment Solution to easily decrypt the credentials. > > -- Vendor Response: > Symantec has issued an update to correct this vulnerability. More > details can be found at: > > http://www.symantec.com/avcenter/security/Content/2008.05.14a.html > > -- Disclosure Timeline: > 2008-02-07 - Vulnerability reported to vendor > 2008-05-15 - Coordinated public release of advisory > > -- Credit: > This vulnerability was discovered by: > * Brett Moore of Insomnia Security www.insomniasec.com > > -- About the Zero Day Initiative (ZDI): > Established by TippingPoint, The Zero Day Initiative (ZDI) represents > a best-of-breed model for rewarding security researchers for responsibly > disclosing discovered vulnerabilities. > > Researchers interested in getting paid for their security research > through the ZDI can find more information and sign-up at: > > http://www.zerodayinitiative.com > > The ZDI is unique in how the acquired vulnerability information is > used. TippingPoint does not re-sell the vulnerability details or any > exploit code. Instead, upon notifying the affected product vendor, > TippingPoint provides its customers with zero day protection through > its intrusion prevention technology. Explicit details regarding the > specifics of the vulnerability are not exposed to any parties until > an official vendor patch is publicly available. Furthermore, with the > altruistic aim of helping to secure a broader user base, TippingPoint > provides this vulnerability information confidentially to security > vendors (including competitors) who have a vulnerability protection or > mitigation product. > > Our vulnerability disclosure policy is available online at: > > http://www.zerodayinitiative.com/advisories/disclosure_policy/ > > CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, > is being sent by 3Com for the sole use of the intended recipient(s) and > may contain confidential, proprietary and/or privileged information. > Any unauthorized review, use, disclosure and/or distribution by any > recipient is prohibited. If you are not the intended recipient, please > delete and/or destroy all copies of this message regardless of form and > any included attachments and notify 3Com immediately by contacting the > sender via reply e-mail or forwarding to 3Com at [EMAIL PROTECTED] > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
