Description: Brian Gallagher has reported a security issue in Altiris Deployment Solution, which potentially can be exploited by malicious people to compromise certain systems.
The problem is that the Altiris Deployment Solution client agents don't verify the authenticity of the Altiris Deployment Solution server system. This can be exploited by malicious people to install and execute arbitrary code on client systems by running a rogue Altiris Deployment Solution server system on the local network.
The security issue has been reported in versions 5.x and 6.1sp1 and prior.
Solution: This will be fixed in the upcoming version 6.5.
The exposure can be limited by configuring the client to use a fixed IP address for the Altiris Deployment Solution server system, instead of relying on multicast to locate it.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
