vulnerability bulletin CVE-2011-3478 CVE-2011-3479 CVE-2012-0290

Symantec pcAnywhere: code execution

Synthesis of the vulnerability

A local or remote attacker can use several vulnerabilities of Symantec pcAnywhere, in order to execute privileged code on the system.
Impacted products: pcAnywhere.
Severity: 3/4.
Creation date: 25/01/2012.
Revisions dates: 06/02/2012, 14/02/2012.
Identifiers: BID-51592, BID-51593, BID-51862, BID-51965, CERTA-2012-AVI-032, CVE-2011-3478, CVE-2011-3479, CVE-2012-0290, CVE-2012-0291, NGS00117, NGS00118, SYM12-002, TECH179526, TECH179960, TECH180472, VIGILANCE-VUL-11318, ZDI-12-018.

Description of the vulnerability

Several vulnerabilities were announced in Symantec pcAnywhere.

A remote attacker can connect to the port 5631/tcp and send a long username, which creates a buffer overflow, in order to execute code with System privileges. [severity:3/4; BID-51592, CERTA-2012-AVI-032, CVE-2011-3478, NGS00118, ZDI-12-018]

During the product installation, some files are installed as writable by all users. A local attacker can therefore insert a trojan horse in a file, in order to execute code with System privileges. [severity:3/4; BID-51593, CVE-2011-3479, NGS00117]

When a victim is connected, an attacker could create an exception, which closes the remote connection, but leaves the session open. A attacker can then connect to this session, in order to access to victim's data. [severity:3/4; BID-51862, CVE-2012-0290]

An attacker can send malformed data, in order to block or to stop the application. [severity:2/4; BID-51965, CVE-2012-0291]

A local or remote attacker can therefore use several vulnerabilities of Symantec pcAnywhere, in order to execute privileged code on the system.
Complete Vigil@nce bulletin.... (free access)

Share this bulletin

          

Computer vulnerabilities tracking service

Vigil@nce provides an application vulnerability management. The technology watch team tracks security threats targeting the computer system. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications. The Vigil@nce security watch publishes vulnerability bulletins about threats impacting the information system.