CVE-2009-1430: Symantec Alert Management System IAO.EXE stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote, unauthenticated code execution with a CVSS 2.0 base score of 9.3 and very high EPSS, though no confirmed in-the-wild exploitation or KEV listing.

What it is

IAO.EXE in the Symantec Alert Originator Service (Alert Management System 2, shipped with System Center, AntiVirus, Client Security and Endpoint Protection) contains multiple stack-based buffer overflows. A remote attacker can trigger them with a crafted packet or with data that appears to come from the MsgSys.exe process, leading to arbitrary code execution on the affected host.

Impact

Successful exploitation lets a remote attacker execute arbitrary code with the privileges of the vulnerable service, typically SYSTEM on the management or server host. That gives full control of the machine and, given the products involved, a foothold in the security management infrastructure.

Attack surface

Reached over the network via the Alert Originator Service listening port; the CVSS vector AV:N/AC:M/Au:N indicates no authentication is required, though some attack complexity or conditions apply. No user interaction is described.

Exploitation

Not listed in CISA KEV and no reference carries an exploit tag, but EPSS is 0.55088 (98.98th percentile), indicating a high modeled likelihood of exploitation activity. The record does not confirm public exploit code.

What to do

• Apply the Symantec vendor updates referenced in the advisory (SAV 9.0 MR7, 10.1 MR8, 10.2 MR2, SCS 2.0 MR7 / 3.1 MR8, SEP 11.0 MR3 or later).
• If the Alert Management System is not required, disable or uninstall the Intel Alert Originator Service and block its listening port.
• Restrict network access to the AMS service port to trusted management hosts only, using host firewalls or segmentation.
• Monitor Symantec advisories for end-of-life status and migrate off unsupported AMS2-based products.
• Run the service under a least-privilege account where the product permits, to limit post-exploitation impact.

Detection

• Monitor for crashes or restarts of IAO.EXE and MsgSys.exe on Symantec management and server hosts.
• Alert on unexpected inbound connections to the Alert Originator Service port from hosts outside the management subnet.
• Hunt for child processes spawned by IAO.EXE, which would indicate code execution inside the service.
• Review Windows application and System event logs for service faults and buffer-overflow-related exception codes on affected hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.