Symantec AppStream 5.2.x and Symantec Workspace Streaming (SWS) 6.1.x before 6.1 SP4 do not properly perform authentication which allows remote Workspace Streaming servers and man-in-the-middle attackers to download arbitrary executable files onto a client system and execute these files via unspecified vectors.