The Altiris eXpress NS SC Download ActiveX control in AeXNSPkgDLLib.dll, as used in…
Priority MEDIUM 59Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
The Altiris eXpress NS SC Download ActiveX control in AeXNSPkgDLLib.dll, as used in Symantec Altiris Deployment Solution 6.9.x, Notification Server 6.0.x, and Symantec Management Platform 7.0.x exposes an unsafe method, which allows remote attackers to force the download of arbitrary files and possibly execute arbitrary code via the DownloadAndInstall method.
Why it matters now
EPSS 0.42598 98th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:symantec:altiris_deployment_solution:6.9:*:*:*:*:*:*:* | 6.9 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp1:*:*:*:*:*:* | 6.9 sp1 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp2:*:*:*:*:*:* | 6.9 sp2 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp3:*:*:*:*:*:* | 6.9 sp3 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp4:*:*:*:*:*:* | 6.9 sp4 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp1:*:*:*:*:*:* | 6.0 sp1 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp1_hf12:*:*:*:*:*:* | 6.0 sp1_hf12 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp2:*:*:*:*:*:* | 6.0 sp2 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3:*:*:*:*:*:* | 6.0 sp3 | Vulnerable | Symantec |
- cpe:2.3:a:symantec:altiris_deployment_solution:6.9:*:*:*:*:*:*:* Versions 6.9 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp1:*:*:*:*:*:* Versions 6.9 sp1 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp2:*:*:*:*:*:* Versions 6.9 sp2 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp3:*:*:*:*:*:* Versions 6.9 sp3 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_deployment_solution:6.9:sp4:*:*:*:*:*:* Versions 6.9 sp4 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp1:*:*:*:*:*:* Versions 6.0 sp1 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp1_hf12:*:*:*:*:*:* Versions 6.0 sp1_hf12 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp2:*:*:*:*:*:* Versions 6.0 sp2 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3:*:*:*:*:*:* Versions 6.0 sp3 Vulnerable ·Symantec
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r1:*:*:*:*:*:* | 6.0 sp3_r1 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r10:*:*:*:*:*:* | 6.0 sp3_r10 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r11:*:*:*:*:*:* | 6.0 sp3_r11 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r12:*:*:*:*:*:* | 6.0 sp3_r12 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r13:*:*:*:*:*:* | 6.0 sp3_r13 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r2:*:*:*:*:*:* | 6.0 sp3_r2 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r3:*:*:*:*:*:* | 6.0 sp3_r3 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r4:*:*:*:*:*:* | 6.0 sp3_r4 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r5:*:*:*:*:*:* | 6.0 sp3_r5 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r6:*:*:*:*:*:* | 6.0 sp3_r6 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r7:*:*:*:*:*:* | 6.0 sp3_r7 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r8:*:*:*:*:*:* | 6.0 sp3_r8 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r9:*:*:*:*:*:* | 6.0 sp3_r9 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:management_platform:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:management_platform:7.0:rc5:*:*:*:*:*:* | 7.0 rc5 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:management_platform:7.0:sp1:*:*:*:*:*:* | 7.0 sp1 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:management_platform:7.0:sp2:*:*:*:*:*:* | 7.0 sp2 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:management_platform:7.0:sp3:*:*:*:*:*:* | 7.0 sp3 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:management_platform:7.0:sp4:*:*:*:*:*:* | 7.0 sp4 | Vulnerable | Symantec |
| cpe:2.3:a:symantec:management_platform:7.0:sp5:*:*:*:*:*:* | 7.0 sp5 | Vulnerable | Symantec |
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r1:*:*:*:*:*:* Versions 6.0 sp3_r1 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r10:*:*:*:*:*:* Versions 6.0 sp3_r10 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r11:*:*:*:*:*:* Versions 6.0 sp3_r11 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r12:*:*:*:*:*:* Versions 6.0 sp3_r12 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r13:*:*:*:*:*:* Versions 6.0 sp3_r13 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r2:*:*:*:*:*:* Versions 6.0 sp3_r2 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r3:*:*:*:*:*:* Versions 6.0 sp3_r3 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r4:*:*:*:*:*:* Versions 6.0 sp3_r4 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r5:*:*:*:*:*:* Versions 6.0 sp3_r5 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r6:*:*:*:*:*:* Versions 6.0 sp3_r6 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r7:*:*:*:*:*:* Versions 6.0 sp3_r7 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r8:*:*:*:*:*:* Versions 6.0 sp3_r8 Vulnerable ·Symantec
- cpe:2.3:a:symantec:altiris_notification_server:6.0:sp3_r9:*:*:*:*:*:* Versions 6.0 sp3_r9 Vulnerable ·Symantec
- cpe:2.3:a:symantec:management_platform:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Symantec
- cpe:2.3:a:symantec:management_platform:7.0:rc5:*:*:*:*:*:* Versions 7.0 rc5 Vulnerable ·Symantec
- cpe:2.3:a:symantec:management_platform:7.0:sp1:*:*:*:*:*:* Versions 7.0 sp1 Vulnerable ·Symantec
- cpe:2.3:a:symantec:management_platform:7.0:sp2:*:*:*:*:*:* Versions 7.0 sp2 Vulnerable ·Symantec
- cpe:2.3:a:symantec:management_platform:7.0:sp3:*:*:*:*:*:* Versions 7.0 sp3 Vulnerable ·Symantec
- cpe:2.3:a:symantec:management_platform:7.0:sp4:*:*:*:*:*:* Versions 7.0 sp4 Vulnerable ·Symantec
- cpe:2.3:a:symantec:management_platform:7.0:sp5:*:*:*:*:*:* Versions 7.0 sp5 Vulnerable ·Symantec
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2009-3028
- 2026-10-03 Alias added: GHSA-c3j9-9fc9-p66x
References
More Symantec Altiris Deployment Solution vulnerabilities
- TI-2009-02888 Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS… CVSS 2.0HIGH 9.3
- TI-2009-02890 Buffer overflow in the RunCmd method in the Altiris eXpress NS Console Utilities ActiveX… CVSS 2.0HIGH 9.3
- TI-2008-02192 SQL injection vulnerability in axengine.exe in Symantec Altiris Deployment Solution 6.8.x… CVSS 2.0HIGH 7.5
- TI-2009-03024 Multiple unspecified vulnerabilities in Symantec Altiris Deployment Solution 6.9 might… CVSS 2.0HIGH 10.0
- TI-2008-04353 Stack-based buffer overflow in wp6sr.dll in the Autonomy KeyView SDK 10.4 and earlier, as… CVSS 2.0HIGH 9.3
- TI-2009-02964 Unspecified vulnerability in the AClient agent in Symantec Altiris Deployment Solution… CVSS 2.0HIGH 9.3
Sources
- CVE-2009-3028 · CVE Program
- CVE-2009-3028 · NVD
- FIRST EPSS
- GHSA-c3j9-9fc9-p66x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences