← Vulnerability feed

Vulnerability record · CVE-2009-1431 · published 29 April 2009

CVE-2009-1431: Symantec antivirus vulnerability

Symantec · Antivirus

XFR.EXE in the Intel File Transfer service in the console in Symantec Alert Management System 2 (AMS2), as used in Symantec System Center (SSS); Symantec AntiVirus Server; Symantec AntiVirus Central Quarantine Server; Symantec AntiVirus (SAV) Corporate Edition 9 before 9.0 MR7, 10.0 and 10.1 before 10.1 MR8, and 10.2 before 10.2 MR2; Symantec Client Security (SCS) 2 before 2.0 MR7 and 3 before 3.1 MR8; and Symantec Endpoint Protection (SEP) before 11.0 MR3, allows remote attackers to execute arbitrary code by placing the code on a (1) share or (2) WebDAV server, and then sending the UNC share pathname to this service.

9.3 CVSS 2.0 High EPSS 8.0% · top 5.4%
9.3CVSS 2.0 base score
8.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
5Affected product versions listed by NVD
18References
16 Jun 2026Last modified by NVD

Description

XFR.EXE in the Intel File Transfer service in the console in Symantec Alert Management System 2 (AMS2), as used in Symantec System Center (SSS); Symantec AntiVirus Server; Symantec AntiVirus Central Quarantine Server; Symantec AntiVirus (SAV) Corporate Edition 9 before 9.0 MR7, 10.0 and 10.1 before 10.1 MR8, and 10.2 before 10.2 MR2; Symantec Client Security (SCS) 2 before 2.0 MR7 and 3 before 3.1 MR8; and Symantec Endpoint Protection (SEP) before 11.0 MR3, allows remote attackers to execute arbitrary code by placing the code on a (1) share or (2) WebDAV server, and then sending the UNC share pathname to this service.

AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=786 Third Party Advisory
http://secunia.com/advisories/34856 Third Party Advisory
http://www.securityfocus.com/bid/34675 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id?1022130 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id?1022131 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id?1022132 Third Party AdvisoryVDB Entry
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2 Vendor Advisory
http://www.vupen.com/english/advisories/2009/1204 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50179 Third Party AdvisoryVDB Entry
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=786 Third Party Advisory
http://secunia.com/advisories/34856 Third Party Advisory
http://www.securityfocus.com/bid/34675 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id?1022130 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id?1022131 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id?1022132 Third Party AdvisoryVDB Entry
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2 Vendor Advisory
http://www.vupen.com/english/advisories/2009/1204 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/50179 Third Party AdvisoryVDB Entry

Track CVE-2009-1431 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2010-0108Symantec antivirus memory buffer overflow vulnerabilityBuffer overflow in the cliproxy.objects.1 ActiveX control in the Symantec Client Proxy (CLIproxy.dll) in Symantec AntiVirus 10.0.x, 10.1.x before MR9…EPSS 19%10.0CVE-2009-1429Symantec AMS2 Intel LANDesk CBA Remote Command ExecutionThe Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2) passes crafted packet contents directly to the CreateProcessA …EPSS 88%analysed10.0CVE-2006-2630Symantec Antivirus and Client Security stack buffer overflowSymantec Antivirus 10.1 and Client Security 3.1 contain a stack-based buffer overflow that remote attackers can trigger through unspecified attack ve…EPSS 74%analysed10.0CVE-2004-0444Symantec client firewall vulnerabilityMultiple vulnerabilities in SYMDNS.SYS for Symantec Norton Internet Security and Professional 2002 through 2004, Norton Personal Firewall 2002 throug…EPSS 13%9.8CVE-2016-3645Symantec norton security vulnerabilityInteger overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:…EPSS 25%9.3CVE-2012-4953Symantec antivirus memory buffer overflow vulnerabilityThe decomposer engine in Symantec Endpoint Protection (SEP) 11.0, Symantec Endpoint Protection Small Business Edition 12.0, Symantec AntiVirus Corpor…EPSS 6.0%9.3CVE-2012-0295Symantec endpoint protection code injection vulnerabilityThe Manager service in the management console in Symantec Endpoint Protection (SEP) 12.1 before 12.1 RU1-MP1 allows remote attackers to conduct file-…EPSS 4.0%9.3CVE-2011-0688Symantec antivirus improper authentication vulnerabilityIntel Alert Management System (aka AMS or AMS2), as used in Symantec Antivirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Cente…EPSS 4.0%

Source: NIST National Vulnerability Database (record CVE-2009-1431), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.