Risk: Medium
Vulnerabilities in Altiris Deployment Solution may allow an attacker to gain elevated priviledges or remotely execute code.
The vulnerabilities reside in axengine.exe, which listens for incoming traffic on TCP port 402 by default. It doesn't check the submitted arguments correctly, allowing attackers to submit arbitrary SQL commands and execute arbitrary code.
A vulnerability exists in the user interface, allowing users with restricted privileges to execute programs at a higher privilege level. Another flaw allows users with valid network login credentials to access the Domain Credentials of the Altiris software.
The vulnerabilities are thought to affect all versions of Altiris Deployment Solution up to 6.9.176.