Symantec.pcAnywhere.Host.Services.Remote.Code.Execution

Description

This indicates an attack attempt against a Buffer Overflow vulnerability in Symantec PCAnywhere.
The vulnerability is caused by an error when the vulnerable software handles a client request with overlong username field. It allows a remote attacker to execute arbitrary code via sending a crafted client request.

Affected Products

Symantec pcAnywhere 12.5.x
Symantec IT Management Suite 7.0 pcAnywhere Solution 12.5.x
Symantec IT Management Suite 7.1 pcAnywhere Solution 12.6.x

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Refer to the vendor's web site for suggested workaround.
http://www.symantec.com/business/support/index?page=content&id=TECH179526

References

http://www.exploit-db.com/exploits/19407/ http://www.zerodayinitiative.com/advisories/ZDI-12-018 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120124_00