PT-2009-3191 · Symantec · Symantec Pcanywhere

Published 2009-03-18 · Updated 2018-10-11 · CVE-2009-0538

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec pcAnywhere versions prior to 12.5 SP1

Description The issue allows local users to read and modify arbitrary memory locations, and cause a denial of service, possibly having other unspecified impacts. This is achieved via format string specifiers in the pathname of a remote control file.

Recommendations For versions prior to 12.5 SP1, update to Symantec pcAnywhere version 12.5 SP1 or later to resolve the issue.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2009-0538

Affected Products

Symantec Pcanywhere

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2009-0538 · Security Note
• http://securityresponse.symantec.com/avcenter/security/Content/2009.03.17.html · Vendor Advisory
• http://layereddefense.com/pcanywhere17mar.html · Vendor Advisory
• http://securityfocus.com/archive/1/501930/100/0/threaded · Note
• http://vupen.com/english/advisories/2009/0755 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49291 · Note
• http://osvdb.org/52797 · Note
• http://securitytracker.com/id?1021855 · Note
• http://secunia.com/advisories/34305 · Note
• http://securityfocus.com/bid/33845 · Note