vulnerability note CVE-2009-0538
pcAnywhere: format string attack
Synthesis of the vulnerability
A local attacker can generate a format string attack in pcAnywhere in order to create a denial of service, and possibly to execute code.Impacted products:
BID-33845, CERTA-2009-AVI-108, CVE-2009-0538, SYM09-003, VIGILANCE-VUL-8544.
Description of the vulnerability
The CHF file format describes a server where pcAnywhere can connect.
When the CHF filename contains format strings (%n, %p, etc.), they are interpreted by a function of the printf() family. A format string attack thus occurs.
A local attacker can therefore invite the victim to open a malicious file in order to create a denial of service, and possibly to execute code.Complete Vigil@nce bulletin....
Share this bulletin
Computer vulnerabilities tracking service
Vigil@nce provides networks vulnerabilities bulletins
. The Vigil@nce security watch publishes vulnerability bulletins about threats impacting the information system. Each administrator can customize the list of products for which he wants to receive vulnerability alerts. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications.