http://www.informationweek.com/news/security/vulnerabilities/232601182 By Mathew J. Schwartz InformationWeek February 21, 2012 Code has been published that attackers could use to crash fully patched versions of pcAnywhere on any Windows PC, without first having to authenticate to the PC. The exploit details arrived Friday in the form of a Pastebin post from Johnathan Norman, director of security research at Alert Logic. Advertised as a "PCAnywhere Nuke," the Python code can be used to create a denial of service (DoS) by crashing "the ashost32 service," he said in the post. "It'll be respawned so if you want to be a real pain you'll need to loop this...my initial impressions are that controlling execution will be a pain." He said the exploit works even against the most recent, fully patched version of pcAnywhere (version 12.5.0 build 463 and earlier). "Symantec is aware of the posting and is investigating the claims," said Symantec spokeswoman Katherine James via email. "We have no additional information to provide at this time." Symantec last month recommended that users disable pcAnywhere unless absolutely required, until the company had an opportunity to release a patch (which it did last month) to address a critical vulnerability that would allow attackers to remotely execute arbitrary code on a user's PC. That vulnerability was discovered by Edward Torkington at NGS Secure, who said he was withholding full details of the bug until April 25, 2012, to give people time to patch their pcAnywhere installations. [...] ______________________________________________________________________________ Learn how to be a Pen Tester or a CISSP with Expanding Security online. Get a free class invitation and see how good and fun the program really is. http://www.expandingsecurity.com/PainPillReceived on Wed Feb 22 2012 - 02:05:19 PST
This archive was generated by hypermail 2.2.0 : Wed Feb 22 2012 - 02:03:09 PST