Symantec pcAnywhere Remote Attack Code Surfaces

[InfoSec News <alerts () infosecnews org>]

http://www.informationweek.com/news/security/vulnerabilities/232601182

By Mathew J. Schwartz
InformationWeek
February 21, 2012

Code has been published that attackers could use to crash fully patched 
versions of pcAnywhere on any Windows PC, without first having to 
authenticate to the PC.

The exploit details arrived Friday in the form of a Pastebin post from 
Johnathan Norman, director of security research at Alert Logic. 
Advertised as a "PCAnywhere Nuke," the Python code can be used to create 
a denial of service (DoS) by crashing "the ashost32 service," he said in 
the post. "It'll be respawned so if you want to be a real pain you'll 
need to loop this...my initial impressions are that controlling 
execution will be a pain." He said the exploit works even against the 
most recent, fully patched version of pcAnywhere (version 12.5.0 build 
463 and earlier).

"Symantec is aware of the posting and is investigating the claims," said 
Symantec spokeswoman Katherine James via email. "We have no additional 
information to provide at this time."

Symantec last month recommended that users disable pcAnywhere unless 
absolutely required, until the company had an opportunity to release a 
patch (which it did last month) to address a critical vulnerability that 
would allow attackers to remotely execute arbitrary code on a user's PC. 
That vulnerability was discovered by Edward Torkington at NGS Secure, 
who said he was withholding full details of the bug until April 25, 
2012, to give people time to patch their pcAnywhere installations.

[...]


______________________________________________________________________________
Learn how to be a Pen Tester or a CISSP with Expanding Security online. Get
a free class invitation and see how good and fun the program really is.
http://www.expandingsecurity.com/PainPill