A vulnerability has been reported in Symantec AppStream Client, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to the LaunchObj ActiveX control (launcher.dll) containing e.g. the "installAppMgr()" insecure method. This can be exploited to download and execute arbitrary files in the context of the currently logged-on user.

Successful exploitation allows execution of arbitrary code.

The vulnerability is reported in Symantec AppStream Client versions prior to 5.2.2 SP3 MP1 (LaunchObj versions prior to 5.2.2.865).

Solution
Update to version 5.2.2 SP3 MP1.

Provided and/or discovered by
Will Dormann, CERT/CC

Original Advisory
US-CERT VU#194505:
http://www.kb.cert.org/vuls/id/194505

Symantec (SYM09-001):
http://securityresponse.symantec.com/avcenter/security/Content/2009.01.15.html

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available in Customer Area