Initial Publication Date: Advisory Status: Advisory Severity: CVSS Base Score:
15 Jan 2009 Closed High 9.3
Vulnerabilities were reported in an ActiveX control that Symantec’s AppStream 5.2.x Client installs. Exploitation of this issue could possibly lead to unauthorized information disclosure, system information corruption or potentially allow arbitrary code execution in the context of the user’s browser. Successful exploitation would require user interaction.
Symantec engineers discovered a vulnerable ActiveX control, LaunchObj, in Symantec’s AppStream 5.2.x client during an internal review. CERT also discovered this vulnerable control and reported their findings to Symantec.
Although this control was not intended to be called by an unauthorized server, it failed to properly validate external input. If called by a malicious user able to successfully masquerade as a valid server, this lack of proper validation could potentially allow download of arbitrary code on a client system. This could result in a browser crash or allow unauthorized access to add, modify, overwrite or corrupt existing files on the targeted system. Unauthorized access to the vulnerable control could result in possible arbitrary code execution in the context of the client. An attacker would have to effectively entice a user to download and execute code via a malicious web site that could effectively call this vulnerable control.
Symantec product engineers have developed and released solutions for this issue through Symantec's support download locations as indicated.
Symantec recommends all customers apply the latest available updates to protect against threats of this nature.
Symantec knows of no exploitation of or adverse customer impact from these issues.
The update listed for affected products is available from the following location: