CVE-2009-1429 in AntiVirus
Summary
by MITRE
The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2), as used in Symantec System Center (SSS); Symantec AntiVirus Server; Symantec AntiVirus Central Quarantine Server; Symantec AntiVirus (SAV) Corporate Edition 9 before 9.0 MR7, 10.0 and 10.1 before 10.1 MR8, and 10.2 before 10.2 MR2; Symantec Client Security (SCS) 2 before 2.0 MR7 and 3 before 3.1 MR8; and Symantec Endpoint Protection (SEP) before 11.0 MR3, allows remote attackers to execute arbitrary commands via a crafted packet whose contents are interpreted as a command to be launched in a new process by the CreateProcessA function.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/17/2025
The vulnerability described in CVE-2009-1429 represents a critical remote command execution flaw within the Intel LANDesk Common Base Agent component of Symantec's security suite. This vulnerability exists in multiple Symantec products including the Alert Management System 2, System Center, AntiVirus servers, Client Security versions, and Endpoint Protection platforms. The flaw specifically manifests when the system processes crafted network packets that contain malicious command content, which are then interpreted and executed through the Windows CreateProcessA API function. This represents a fundamental breakdown in input validation and sanitization mechanisms within the LANDesk agent implementation, allowing attackers to escalate privileges and gain full control over affected systems.
The technical exploitation of this vulnerability occurs through the improper handling of network packets that are processed by the LANDesk Common Base Agent. When the agent receives a specially crafted packet, it fails to properly validate or sanitize the contents before passing them to the CreateProcessA Windows API function. This function is designed to create new processes, but due to the lack of proper input validation, malicious payloads can be executed with the privileges of the LANDesk agent process. The vulnerability falls under CWE-78, which specifically addresses improper neutralization of special elements used in OS commands, and more broadly relates to CWE-20, which covers improper input validation. The attack vector is remote and requires no authentication, making it particularly dangerous in networked environments where these agents are deployed.
The operational impact of this vulnerability is severe and far-reaching across Symantec's security product ecosystem. Attackers can leverage this flaw to execute arbitrary code on target systems, potentially leading to complete system compromise, data exfiltration, and lateral movement within networks. The vulnerability affects multiple generations of Symantec security products, creating a widespread exposure that could impact enterprise environments with legacy security infrastructure. Organizations running affected versions of Symantec AntiVirus, Client Security, and Endpoint Protection are at significant risk, as the LANDesk agent is typically deployed across enterprise networks for system monitoring and management purposes. This vulnerability essentially provides attackers with a backdoor mechanism to bypass traditional security controls and gain persistent access to compromised systems.
The mitigation strategies for CVE-2009-1429 primarily involve immediate patching of affected Symantec products to versions that properly validate input before executing commands through the CreateProcessA function. Organizations should implement network segmentation to limit the exposure of LANDesk agents to untrusted networks, and consider disabling unnecessary LANDesk agent functionality where possible. Security monitoring should focus on detecting unusual network traffic patterns that might indicate exploitation attempts, particularly around the ports and protocols used by LANDesk agents. From an ATT&CK framework perspective, this vulnerability maps to technique T1059.003 for command and scripting interpreter, and T1068 for exploit for privilege escalation, making it a critical indicator for security operations teams to monitor for potential exploitation attempts. Additionally, organizations should review their network access controls and ensure that only authorized systems can communicate with LANDesk agent services to minimize the attack surface.