CVE-2009-3035
The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded...
The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded key that can decrypt SQL Server credentials and certain discovery credentials, and stores this key on the Notification Server machine, which allows local users to obtain sensitive information and possibly execute arbitrary code by decrypting and using these credentials.
Exploit likelihood
What each source reports
NVD Score used
The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded key that can decrypt SQL Server credentials and certain discovery credentials, and stores this key on the Notification Server machine, which allows local users to obtain sensitive information and possibly execute arbitrary code by decrypting and using these credentials.
- Record
CVE-2009-3035- CVSS 2.0
- 4.3 Medium
AV:L/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE List No score
The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded key that can decrypt SQL Server credentials and certain discovery credentials, and stores this key on the Notification Server machine, which allows local users to obtain sensitive information and possibly execute arbitrary code by decrypting and using these credentials.
- Record
CVE-2009-3035- Updated
- 2026-11-02
EUVDEUVD-2009-3019 No score
The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded key that can decrypt SQL Server credentials and certain discovery credentials, and stores this key on the Notification Server machine, which allows local users to obtain sensitive information and possibly execute arbitrary code by decrypting and using these credentials.
- Record
EUVD-2009-3019- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2c59-mm9r-vwwg No score
The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded...
The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded key that can decrypt SQL Server credentials and certain discovery credentials, and stores this key on the Notification Server machine, which allows local users to obtain sensitive information and possibly execute arbitrary code by decrypting and using these credentials.
- Record
GHSA-2c59-mm9r-vwwg- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3035 is a medium vulnerability (CVSS 4.3) in Symantec Altiris Notification Server, published February 2, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. No source names a fixed version.
References
secunia.com/advisories/38356
securityfocus.com/bid/37953
osvdb.org/62010
symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20100128_00
securitytracker.com/id?1023521
exchange.xforce.ibmcloud.com/vulnerabilities/55952
vupen.com/english/advisories/2010/0256
nvd.nist.gov/vuln/detail/CVE-2009-3035
github.com/advisories/GHSA-2c59-mm9r-vwwg