Vulnerable Systems:
* Symantec Antivirus Corporate Edition 10.1.8.8000
* Symantec System Center 10.1.8.8000
The vulnerability could be exploited by remote unauthenticated attackers to execute arbitrary code with SYSTEM privileges.
The Alert Management System (AMS) component of Symantec Antivirus Corporate Edition installs an alert handler service, HNDLRSVC, that listens for commands from the AMS server. This service does not perform proper authentication checks before executing such commands. Remote unauthenticated attackers could exploit this vulnerability by sending a crafted packet via the MSGSYS.EXE service on port 38292/TCP. The Run Program command would allow executing arbitrary programs from a remote SMB share with SYSTEM privileges on the vulnerable system.
Workaround:
Disable the AMS service, or update to the non-vulnerable version of Symantec Antivirus 11.x series which does not include the vulnerable AMS component.
