CVE-2009-3035 in Altiris Notification Server
Summary
by MITRE
The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded key that can decrypt SQL Server credentials and certain discovery credentials, and stores this key on the Notification Server machine, which allows local users to obtain sensitive information and possibly execute arbitrary code by decrypting and using these credentials.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/29/2026
The vulnerability described in CVE-2009-3035 represents a critical security flaw within Symantec Altiris Notification Server 6.0.x versions prior to 6.0 SP3 R12. This issue stems from the improper implementation of cryptographic security measures within the web console component of the notification server. The flaw manifests through the use of a hardcoded encryption key that is embedded within the application code and stored locally on the notification server machine, creating a persistent security risk that affects the entire system's integrity.
The technical implementation of this vulnerability involves a fundamental weakness in the encryption methodology used by the Symantec Altiris system. The hardcoded key serves as a master decryption mechanism that can be used to reverse engineer SQL Server credentials and discovery credentials stored within the system. This represents a classic example of weak cryptographic key management practices and violates established security principles. According to CWE-327, this vulnerability directly relates to the use of weak or broken cryptographic algorithms, specifically the use of hardcoded keys rather than properly managed key infrastructure. The presence of such a key on the local machine creates an attack surface that allows local privilege escalation and credential theft scenarios.
The operational impact of this vulnerability extends beyond simple credential exposure, as it provides attackers with the potential to execute arbitrary code within the system. Once an attacker gains access to the hardcoded key through local system access, they can decrypt sensitive credentials and leverage these to perform unauthorized actions within the network management environment. This creates a significant risk for enterprise environments where the notification server typically manages critical infrastructure monitoring and management functions. The vulnerability affects the confidentiality, integrity, and availability of the system by allowing unauthorized access to sensitive data and potential system compromise.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1552.001, which covers "Unsecured Credentials" and involves the extraction of credentials from memory or storage. The attack path typically begins with local system access, followed by key extraction from the notification server machine, credential decryption, and subsequent privilege escalation. Organizations using Symantec Altiris systems were particularly vulnerable because the hardcoded key was stored in a location accessible to local users, violating the principle of least privilege and creating a persistent backdoor for attackers. The vulnerability demonstrates the importance of proper key management practices and the dangers of embedding cryptographic keys within application code. System administrators should immediately apply the vendor-supplied patch for SP3 R12 to remediate this issue, as the hardcoded key represents a fundamental flaw in the system's security architecture that cannot be adequately mitigated through network-level controls alone.