{"schemaVersion":3,"id":"CVE-2008-6827","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a \"Shatter\" style attack on the \"command prompt\" hidden GUI button to (1) overwrite the CommandLine parameter to cmd.exe to use SYSTEM privileges and (2) modify the DLL that is loaded using the LoadLibrary API function.","dates":{"published":"2009-06-08T19:00:00.000Z","modified":"2024-08-07T11:42:00.467Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:L/AC:L/Au:S/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01084,"percentile":0.64673,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.01084},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01084,"percentile":0.64673}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01084,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01084,"percentile":0.64673}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-306","name":"Missing Authentication for Critical Function","description":"The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/306.html"}],"affected":[{"vendor":"symantec","product":"altiris_deployment_solution","name":"altiris deployment solution","label":"altiris_deployment_solution","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 6.0, < 6.9.355","noFixRecorded":false,"fixedIn":null},{"text":"6.9.355","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.0, < 6.9.355 | 6.9.355","eol":null,"hubHref":"/vendor/symantec/altiris_deployment_solution"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securitytracker.com/id?1021071","label":"www.securitytracker.com/id?1021071","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq&m=122460544316205&w=2","label":"marc.info?l=bugtraq&m=122460544316205&w=2","hostname":"marc.info","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://www.symantec.com/avcenter/security/Content/2008.10.20a.html","label":"www.symantec.com/avcenter/security/Content/2008.10.20a.html","hostname":"www.symantec.com","tags":["X Refsource CONFIRM","Broken Link","Patch","Vendor Advisory"]},{"url":"http://secunia.com/advisories/31773","label":"secunia.com/advisories/31773","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46006","label":"exchange.xforce.ibmcloud.com/vulnerabilities/46006","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2008/2876","label":"www.vupen.com/english/advisories/2008/2876","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link","Patch","Vendor Advisory"]},{"url":"http://osvdb.org/49426","label":"osvdb.org/49426","hostname":"osvdb.org","tags":["VDB Entry","X Refsource OSVDB","Broken Link"]},{"url":"http://www.insomniasec.com/advisories/ISVA-081020.1.htm","label":"www.insomniasec.com/advisories/ISVA-081020.1.htm","hostname":"www.insomniasec.com","tags":["X Refsource MISC","Broken Link","Patch"]},{"url":"http://www.securityfocus.com/bid/31766","label":"www.securityfocus.com/bid/31766","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2009-06-08T19:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T11:42:00.467Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T13:40:42.471Z","stale":false,"partial":false}}