$ cve CVE-2009-3031 JSON

CVE-2009-3031 EXPLOIT

9.3

HIGH · CVSS 2.0 · EPSS 45.4% (pctl 99)

Patch early

A public exploit exists.

Description

Stack-based buffer overflow in the BrowseAndSaveFile method in the Altiris eXpress NS ConsoleUtilities ActiveX control 6.0.0.1846 in AeXNSConsoleUtilities.dll in Symantec Altiris Notification Server (NS) 6.0 before R12, Deployment Server 6.8 and 6.9 in Symantec Altiris Deployment Solution 6.9 SP3, and Symantec Management Platform (SMP) 7.0 before SP3 allows remote attackers to execute arbitrary code via a long string in the second argument.

Scoring

CVSS	9.3 (HIGH, v2.0)
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS	45.44% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	yes
Published	2009-11-03
Last modified	2026-06-16

Affected (3)

Vendor	Product
symantec	altiris deployment solution
symantec	altiris management platform
symantec	altiris notification server

Public exploits

Source	Title	Date
exploit-db	Symantec ConsoleUtilities - ActiveX Control Buffer Overflow (Metasploit)	2010-11-11
exploit-db	Symantec ConsoleUtilities - ActiveX Buffer Overflow (Metasploit)	2009-11-02

References

→ the Explorer · watch your stack · NVD