Symantec Products Intel Alert Handler Remote DoS

Medium Nessus Plugin ID 51190


The remote Windows host has a service that is affected by a denial of service vulnerability.


Intel Alert Handler Service (hndlrsvc.exe) included with Alert Management System 2 (AMS2), an optional component included with either Symantec Antivirus Corporate Edition or Symantec Endpoint Protection version prior to 11.x, is installed on the remote host. The installed service reportedly fails to correctly handle 'CommandLine' field in an AMS request, and could be exploited by a remote attacker to crash the affected service.


Either upgrade to version 11.x since it does not use Intel AMS code or disable Intel AMS.

See Also

Plugin Details

Severity: Medium

ID: 51190

File Name: symantec_intel_alert_handler_svc_dos.nasl

Version: $Revision: 1.8 $

Type: local

Agent: windows

Family: Windows

Published: 2010/12/15

Modified: 2016/11/03

Dependencies: 21725, 10456

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND

Vulnerability Information

CPE: cpe:/a:symantec:endpoint_protection, cpe:/a:intel:intel_alert_management_system

Required KB Items: Antivirus/SAVCE/version, SMB/svc/Intel Alert Handler

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2010/12/13

Vulnerability Publication Date: 2010/12/13

Exploitable With

Core Impact

Reference Information

CVE: CVE-2010-3268

BID: 45368

OSVDB: 70002

Secunia: 42593