:Two vulnerabilities have been reported in Symantec Altiris Deployment Solution, which can be exploited by malicious, local users to disclose potentially sensitive information and gain escalated privileges.1) The Aclient process runs with SYSTEM privileges and allows opening and execution of arbitrary files with SYSTEM privileges via the browser option.2) An input validation error can be exploited to e.g. read privileged system files via directory traversal attacks.The vulnerabilities are reported in versions 6.x SP2 (#1) and 6.8 SP2 (#2).Solution:Update to version 6.8.380.0 (see vendor’s advisories for more information).Provided and/or discovered by:The vendor credits:1) Mazin Faour, Information Risk Management2) Manuel Santamarina SuarezOriginal Advisory:http://securityresponse.symantec.com/avcenter/security/Content/2007.10.31a.htmlhttp://securityresponse.symantec.com/avcenter/security/Content/2007.10.31.html

Original post by Pankaj