Symantec Products Intel Alert Handler Remote DoS

medium Nessus Plugin ID 51190



The remote Windows host has a service that is affected by a denial of service vulnerability.


Intel Alert Handler Service (hndlrsvc.exe) included with Alert Management System 2 (AMS2), an optional component included with either Symantec Antivirus Corporate Edition or Symantec Endpoint Protection version prior to 11.x, is installed on the remote host. The installed service reportedly fails to correctly handle 'CommandLine' field in an AMS request, and could be exploited by a remote attacker to crash the affected service.


Either upgrade to version 11.x since it does not use Intel AMS code or disable Intel AMS.

See Also

Plugin Details

Severity: Medium

ID: 51190

File Name: symantec_intel_alert_handler_svc_dos.nasl

Version: 1.11

Type: local

Agent: windows

Family: Windows

Published: 12/15/2010

Updated: 6/12/2020

Supported Sensors: Nessus Agent

Risk Information


Risk Factor: Medium

Score: 5.1


Risk Factor: Medium

Base Score: 5

Temporal Score: 4.1

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: E:F/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:symantec:endpoint_protection, cpe:/a:intel:intel_alert_management_system

Required KB Items: Antivirus/SAVCE/version, SMB/svc/Intel Alert Handler

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/13/2010

Vulnerability Publication Date: 12/13/2010

Exploitable With

Core Impact

Reference Information

CVE: CVE-2010-3268

BID: 45368

Secunia: 42593