CVE-2009-3035
The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded key that can decrypt SQL Server credentials and certain discovery credentials, and stores this key on the Notification Server machine, which allows local users to obtain sensitive information and possibly execute arbitrary code by decrypting and using these credentials.
Key facts
- CVSS score
- 4.3 (v2.0)
- Severity
- MEDIUM
- CVSS vector
AV:L/AC:L/Au:S/C:P/I:P/A:P- Weakness (CWE)
- CWE-255
- EPSS score
- 0.4% (31th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2009-3019)
- Published
- February 2, 2010
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2009-3019 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- symantec / altiris notification server
- symantec / altiris notification server
- symantec / altiris notification server
- symantec / altiris notification server
- symantec / altiris notification server
- symantec / altiris notification server
References
- http://osvdb.org/62010
- http://secunia.com/advisories/38356(Vendor Advisory)
- http://www.securityfocus.com/bid/37953
- http://www.securitytracker.com/id?1023521
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20100128_00
- http://www.vupen.com/english/advisories/2010/0256
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55952
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain