Detections
Analytics

Symantec Products Intel Alert Handler Remote DoS

medium Nessus Plugin ID 51190

Language:

Synopsis

The remote Windows host has a service that is affected by a denial of service vulnerability.

Description

Intel Alert Handler Service (hndlrsvc.exe) included with Alert Management System 2 (AMS2), an optional component included with either Symantec Antivirus Corporate Edition or Symantec Endpoint Protection version prior to 11.x, is installed on the remote host. The installed service reportedly fails to correctly handle 'CommandLine' field in an AMS request, and could be exploited by a remote attacker to crash the affected service.

Solution

Either upgrade to version 11.x since it does not use Intel AMS code or disable Intel AMS.

See Also

http://www.nessus.org/u?3ccc88b8

https://seclists.org/fulldisclosure/2010/Dec/261

Plugin Details

Severity: Medium

ID: 51190

File Name: symantec_intel_alert_handler_svc_dos.nasl

Version: 1.11

Type: local

Agent: windows

Family: Windows

Published: 12/15/2010

Updated: 6/12/2020

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.1

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: cpe:/a:symantec:endpoint_protection, cpe:/a:intel:intel_alert_management_system

Required KB Items: Antivirus/SAVCE/version, SMB/svc/Intel Alert Handler

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/13/2010

Vulnerability Publication Date: 12/13/2010

Exploitable With

Core Impact

Reference Information

CVE: CVE-2010-3268

BID: 45368

Secunia: 42593