PT-2012-1709 · Symantec · Pcanywhere+1

Tal Zeltzer · Published 2012-01-25 · Updated 2018-01-06 · CVE-2011-3478

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec pcAnywhere versions 12.5.x through 12.5.3 Symantec IT Management Suite pcAnywhere Solution version 7.0 (aka 12.5.x) Symantec IT Management Suite pcAnywhere Solution version 7.1 (aka 12.6.x)

Description The issue is related to the host-services component, which does not properly filter login and authentication data. This allows remote attackers to execute arbitrary code via a crafted session on TCP port 5631, specifically the API endpoint on port 5631.

Recommendations For Symantec pcAnywhere versions 12.5.x through 12.5.3, consider restricting access to the host-services component until a patch is available. For Symantec IT Management Suite pcAnywhere Solution version 7.0 (aka 12.5.x), restrict access to the host-services component to minimize the risk of exploitation. For Symantec IT Management Suite pcAnywhere Solution version 7.1 (aka 12.6.x), avoid using the vulnerable host-services component in the API endpoint on port 5631 until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2011-3478

ZDI-12-018

Affected Products

It Management Suite Pcanywhere Solution

Pcanywhere

References · 9

• 🔥 https://exploit-db.com/exploits/38599 · Exploit
• 🔥 https://exploit-db.com/exploits/19407 · Exploit
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120124_00 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3478 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-12-018 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-12-018 · Note
• http://osvdb.org/show/osvdb/78532 · Note
• http://securityfocus.com/bid/51592 · Note
• http://secunia.com/advisories/48092 · Note