Symantec and the U.S. Computer Emergency Readiness Team (CERT) are warning about a serious vulnerability within the company's AppStream product, used for steaming applications from a central server to thin-client desktops, though a patch has been released.
The product affected is AppStream version 5.2, which is part of the Symantec Endpoint Virtualization Suite formerly known as Software Virtualization Solution (SVS) Pro.
The problem lies in the LaunchObj ActiveX control, which fails to validate external input when called on by an unauthorized server. CERT wrote in a brief advisory on Friday that if a user can be convinced into viewing a specially crafted HTML (Hypertext Markup Language) document, a hacker could execute arbitrary code with the privileges of that user.
Symantec has created an update to fix the problem and advised administrators to apply it.
Both Symantec and CERT discovered the flaw, which Symantec rated as “high” severity. However, it appears that no exploits have been publicly released.
Symantec acquired AppStream in April 2008. Symantec had sold the AppStream software since 2006.
Related Articles
“My long-term aspiration and ambition for IFS is for us to dominate asset and service” – Mark Moffat
“We can bring simplicity and efficiency to our customers when it comes to adopting AI.” – Ranjith Kaippada, Cloud Box Technologies
“The air and liquid cooling solutions that we provide are among the most efficient in the world” – Anastasios Peppas, Vertiv