CVE-2011-3478
Symantec PCAnywhere awhost32 Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
The host-services component in Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), does not properly filter login and authentication data, which allows remote attackers to execute arbitrary code via a crafted session on TCP port 5631.
El componente de host de servicios de Symantec pcAnywhere v12.5.x a través de v12.5.3, y IT Management Suite pcAnywhere Solution v7.0 (aka 12.5.x) y v7.1 (también conocido como 12.6.x), de inicio de sesión de filtro y los datos de autenticación, es que permite control remoto atacantes para ejecutar código arbitrario a través de una sesión a mano en el puerto TCP 5631.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec PCAnywhere. Authentication is not required to exploit this vulnerability.
The flaw exists within the awhost32 component which is used when handling incoming connections. This process listens on TCP port 5631. When handling an authentication request the process copies the user supplied username unsafely to a fixed-length buffer of size 0x108. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the SYSTEM account.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2011-09-14 CVE Reserved
- 2012-01-25 CVE Published
- 2012-06-27 First Exploit
- 2024-08-06 CVE Updated
- 2024-09-14 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-287: Improper Authentication
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| http://osvdb.org/show/osvdb/78532 | Vdb Entry | |
| http://secunia.com/advisories/48092 | Third Party Advisory | |
| http://www.securityfocus.com/bid/51592 | Vdb Entry | |
| http://www.zerodayinitiative.com/advisories/ZDI-12-018 | X_refsource_confirm |
|
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/19407 | 2012-06-27 | |
| https://www.exploit-db.com/exploits/38599 | 2024-08-06 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Symantec Search vendor "Symantec" | Pcanywhere Search vendor "Symantec" for product "Pcanywhere" | 12.5 Search vendor "Symantec" for product "Pcanywhere" and version "12.5" | - |
Affected
| ||||||
| Symantec Search vendor "Symantec" | Pcanywhere Search vendor "Symantec" for product "Pcanywhere" | 12.5 Search vendor "Symantec" for product "Pcanywhere" and version "12.5" | sp1 |
Affected
| ||||||
| Symantec Search vendor "Symantec" | Pcanywhere Search vendor "Symantec" for product "Pcanywhere" | 12.5 Search vendor "Symantec" for product "Pcanywhere" and version "12.5" | sp2 |
Affected
| ||||||
| Symantec Search vendor "Symantec" | Pcanywhere Search vendor "Symantec" for product "Pcanywhere" | 12.5 Search vendor "Symantec" for product "Pcanywhere" and version "12.5" | sp3 |
Affected
| ||||||
| Symantec Search vendor "Symantec" | Pcanywhere Search vendor "Symantec" for product "Pcanywhere" | 12.5.539 Search vendor "Symantec" for product "Pcanywhere" and version "12.5.539" | - |
Affected
| ||||||
| Symantec Search vendor "Symantec" | Pcanywhere Search vendor "Symantec" for product "Pcanywhere" | 12.6.65 Search vendor "Symantec" for product "Pcanywhere" and version "12.6.65" | - |
Affected
| ||||||
| Symantec Search vendor "Symantec" | Pcanywhere Search vendor "Symantec" for product "Pcanywhere" | 12.6.65 Search vendor "Symantec" for product "Pcanywhere" and version "12.6.65" | sp1 |
Affected
| ||||||
| Symantec Search vendor "Symantec" | Pcanywhere Search vendor "Symantec" for product "Pcanywhere" | 12.6.7580 Search vendor "Symantec" for product "Pcanywhere" and version "12.6.7580" | - |
Affected
| ||||||