Zero Day Initiative Advisory 09-018 – This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Symantec Client Security. Authentication is not required to exploit this vulnerability. The specific flaw resides in the Alert Originator service, iao.exe, which listens by default on TCP port 38292. The process blindly copies user-supplied data to a stack buffer via a memcpy call. By supplying a specially crafted packet, an attacker can overflow that buffer leading to arbitrary code execution in the context of the SYSTEM user.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/77103/ZDI-09-018.txt
Source: https://packetstormsecurity.com/files/77103/Zero-Day-Initiative-Advisory-09-018.html