Symantec pcAnywhere awhost32 Remote Code Execution Vulnerability

Release date:
Updated on:

Affected Systems:
Symantec pcAnywhere <12.6
Description:
--------------------------------------------------------------------------------
Bugtraq id: 51592
Cve id: CVE-2011-3478

Symantec PCAnywhere is the world's best-selling remote control solution for managing servers and providing administrative support.

A remote code execution vulnerability exists in pcAnywhere. Attackers can exploit this vulnerability to execute arbitrary code in affected applications to gain full control.

This vulnerability is caused by the awhost32 component used to process inbound connections. This process listens on TCP port 5631. When processing an authentication request, the process copies user data to a buffer in the size of 0x108.

<* Source: Tal Zeltzer

Link: http://www.zerodayinitiative.com/advisories/ZDI-12-018/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Symantec
--------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.symantec.com/business/security_response/