Intel Alert Management System (aka AMS or AMS2), as used in Symantec Antivirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec Sys

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• symantec antivirus10.0
• symantec antivirus10.0.1
• symantec antivirus10.0.1.1
• symantec antivirus10.0.1.2
• symantec antivirus10.0.2
• symantec antivirus10.0.2.1
• symantec antivirus10.0.2.2
• symantec antivirus10.0.3
• symantec antivirus10.0.4
• symantec antivirus10.0.5
• symantec antivirus10.0.6
• symantec antivirus10.0.7
• symantec antivirus10.0.8
• symantec antivirus10.0.9
• symantec antivirus10.1
• symantec antivirus10.1.0.1
• symantec antivirus10.1.4
• symantec antivirus10.1.4.1
• symantec antivirus10.1.5
• symantec antivirus10.1.5.1

Other highest-scoring records for the same primary product.

• CVE-2009-1429The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2), as used in Symantec System Center (SSS); Symantec An
  66This week
• CVE-2009-1430Multiple stack-based buffer overflows in IAO.EXE in the Intel Alert Originator Service in Symantec Alert Management System 2 (AMS2), as used
  54Plan
• CVE-2010-0111HDNLRSVC.EXE in the Intel Alert Handler service (aka Symantec Intel Handler service) in Intel Alert Management System (aka AMS or AMS2), as
  47Plan
• CVE-2010-0108Buffer overflow in the cliproxy.objects.1 ActiveX control in the Symantec Client Proxy (CLIproxy.dll) in Symantec AntiVirus 10.0.x, 10.1.x b
  46Plan
• CVE-2012-4953The decomposer engine in Symantec Endpoint Protection (SEP) 11.0, Symantec Endpoint Protection Small Business Edition 12.0, Symantec AntiVir
  39Monitor
• CVE-2009-1431XFR.EXE in the Intel File Transfer service in the console in Symantec Alert Management System 2 (AMS2), as used in Symantec System Center (S
  39Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Authentication is added route by route instead of being enforced in one place. When a route added later bypasses the shared middleware, the session check never runs for it.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1app.use("/admin", requireSession, adminRouter);2
3// Route added later skips the middleware4app.post("/admin-api/config", updateConfig);

1const admin = express.Router();2admin.use(requireSession, requireRole("admin"));3
4admin.post("/config", updateConfig);5app.use("/admin", admin);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.