vulnerability note CVE-2009-0538

pcAnywhere: format string attack

Synthesis of the vulnerability

A local attacker can generate a format string attack in pcAnywhere in order to create a denial of service, and possibly to execute code.
Impacted products: pcAnywhere.
Severity: 2/4.
Creation date: 18/03/2009.
Identifiers: BID-33845, CERTA-2009-AVI-108, CVE-2009-0538, SYM09-003, VIGILANCE-VUL-8544.

Description of the vulnerability

The CHF file format describes a server where pcAnywhere can connect.

When the CHF filename contains format strings (%n, %p, etc.), they are interpreted by a function of the printf() family. A format string attack thus occurs.

A local attacker can therefore invite the victim to open a malicious file in order to create a denial of service, and possibly to execute code.
Complete Vigil@nce bulletin.... (free access)

Share this bulletin

          

Computer vulnerabilities tracking service

Vigil@nce provides networks vulnerabilities bulletins. The Vigil@nce security watch publishes vulnerability bulletins about threats impacting the information system. Each administrator can customize the list of products for which he wants to receive vulnerability alerts. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications.