The LaunchObj ActiveX control before 5.2.2.865 in launcher.dll in Symantec AppStream Client 5.2.x before 5.2.2 SP3 MP1 does not properly va…

published 2009-01-20 17 y ago modified 2026-06-16 4 mo ago also EUVD-2008-4369

cvss: 9.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 37.7%; EPSS 37.7% chance of exploitation in 30 days, percentile 98%
public exploits: 2; Metasploit, Exploit-DB

The LaunchObj ActiveX control before 5.2.2.865 in launcher.dll in Symantec AppStream Client 5.2.x before 5.2.2 SP3 MP1 does not properly validate downloaded files, which allows remote attackers to execute arbitrary code via the installAppMgr method and unspecified other methods.

Patch / fix

links 1

symantec.com/avcenter/security/Content/2009.01.15.html advisory

Timeline

2009-01-15 First public exploit (Metasploit exploit/windows/browser/symantec_appstream_unsafe)
2009-01-20 Published

Exploit prediction

37.72% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/windows/browser/symantec_appstream_unsafe Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execute metasploit exploit, excellent rank, 2009-01-15
EDB-16512 Symantec AppStream LaunchObj - ActiveX Control Arbitrary File Download and Execute (Metasploit) remote, 2010-11-24

CVSS scores

assigned by	version	score	vector
NVD	2.0	9.3	AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-20 Improper Input Validation

References

symantec.com /avcenter/security/Content/2009.01.15.html
patch, vendor-advisory
kb.cert.org /vuls/id/194505
third-party-advisory, us-government-resource
securityfocus.com /bid/33247
vdb-entry
securitytracker.com /id?1021609
vdb-entry

Sources

CVE List CVE-2008-4388
NVD CVE-2008-4388

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary