Detections
Analytics
Intel Common Base Agent CreateProcessA() Function Remote Command Execution
critical Nessus Plugin ID 38664
Language:
Synopsis
The remote service seems to allow execution of arbitrary commands.Description
The remote host seems to be running a version of the Intel LANDesk Common Base Agent (CBA) that allows the contents of a specially crafted packet to be passed as an argument to 'CreateProcessA()' to be executed on the remote host with SYSTEM privileges.Solution
If using Symantec AntiVirus Corporate Edition, Symantec Client Security, or Symantec Endpoint Protection, apply the appropriate update as described in Symantec's advisory referenced above.Otherwise, contact the application's vendor for an update.
See Also
Plugin Details
Severity: Critical
ID: 38664
File Name: landesk_cba_createprocessa_cmd_exec.nasl
Version: 1.17
Type: remote
Agent: windows
Family: Windows
Published: 5/3/2009
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Exploitable With
CANVAS (D2ExploitPack)
Core Impact
Metasploit (Symantec System Center Alert Management System (xfr.exe) Arbitrary Command Execution)
Reference Information
CVE: CVE-2009-1429
BID: 34671