CVE-2010-0111 Command injection in n/a
Remote attackers can execute arbitrary programs on Symantec AntiVirus servers by sending a malicious UNC path to the Intel Alert Handler service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2010-0111?
CVE-2010-0111 is a critical command injection vulnerability in n/a, published on 31 Jan 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HDNLRSVC.EXE in the Intel Alert Handler service (aka Symantec Intel Handler service) in Intel Alert Management System (aka AMS or AMS2), as used in Symantec AntiVirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec Quarantine Server 3.5 and 3.6, allows remote attackers to execute arbitrary programs by sending msgsys.exe a UNC share pathname, which is used directly in a CreateProcessA (aka CreateProcess) call.
Weakness: CWE-20
Which versions are affected by CVE-2010-0111?
It affects 3 products.
Products include Symantec Antivirus, Symantec Antivirus Central Quarantine Server, Symantec System Center.
How do I fix CVE-2010-0111?
No fix has been published for CVE-2010-0111 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2010-0111 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-0111 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in n/a
Sources
Also known as GHSA-c8p5-6xf7-qcx4.