[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[ISN] Symantec pcAnywhere Remote Attack Code Surfaces
By Mathew J. Schwartz
February 21, 2012
Code has been published that attackers could use to crash fully patched
versions of pcAnywhere on any Windows PC, without first having to
authenticate to the PC.
The exploit details arrived Friday in the form of a Pastebin post from
Johnathan Norman, director of security research at Alert Logic.
Advertised as a "PCAnywhere Nuke," the Python code can be used to create
a denial of service (DoS) by crashing "the ashost32 service," he said in
the post. "It'll be respawned so if you want to be a real pain you'll
need to loop this...my initial impressions are that controlling
execution will be a pain." He said the exploit works even against the
most recent, fully patched version of pcAnywhere (version 12.5.0 build
463 and earlier).
"Symantec is aware of the posting and is investigating the claims," said
Symantec spokeswoman Katherine James via email. "We have no additional
information to provide at this time."
Symantec last month recommended that users disable pcAnywhere unless
absolutely required, until the company had an opportunity to release a
patch (which it did last month) to address a critical vulnerability that
would allow attackers to remotely execute arbitrary code on a user's PC.
That vulnerability was discovered by Edward Torkington at NGS Secure,
who said he was withholding full details of the bug until April 25,
2012, to give people time to patch their pcAnywhere installations.
Learn how to be a Pen Tester or a CISSP with Expanding Security online. Get
a free class invitation and see how good and fun the program really is.