Menu
Researcher releases exploit code that can allegedly crash pcAnywhere

Researcher releases exploit code that can allegedly crash pcAnywhere

Exploit code for a denial-of-service vulnerability identified in Symantec's pcAnywhere product, was published on the Internet

Exploit code targeting a newly identified vulnerability in Symantec's pcAnywhere computer remote control product has been published on the Internet, exposing its users to possible attacks that disrupt the software's functionality.

The code was published Friday on Pastebin by Johnathan Norman, director of security research at network security vendor Alert Logic, and can be used to crash an important pcAnywhere service called awhost32.

The denial-of-service (DoS) condition is not persistent, because the awhost32 process is restarted automatically, Norman said. This means that attackers would need to execute the exploit in a loop in order to create longer disruptions.

This is just one of several vulnerabilities that Norman claims to have identified in pcAnywhere while investigating a more serious remote code execution flaw patched by Symantec last month. "Not sure what I'm going to do with all of them," Norman said in a blog post on Friday.

According to the researcher, the exploit works against fully patched versions of pcAnywhere. "Symantec is aware of the posting and is investigating the claims," a Symantec spokesman said via email. The company could not provide any additional information at this time.

This vulnerability disclosure comes after hackers associated with the hacktivist group Anonymous leaked the source code of pcAnywhere on the Internet at the beginning of this month.

Following the source code's theft in early January, Symantec recommended that pcAnywhere users disable the application until it had a chance to issue patches for several vulnerabilities found in the product. Later that same month, the company gave pcAnywhere a clean bill of health after releasing several hotfixes.

However, the leak of the product's source code could theoretically pave the way for the identification of other vulnerabilities. An analysis of the leaked pcAnywhere files and documents performed by an anonymous researcher and published Friday by the InfoSec Institute concluded that the application has not changed much over the years. The current version is probably a continuation of the old code base instead of a rewrite.

Follow Us

Join the ARN newsletter!

Error: Please check your email address.

Upcoming

Slideshows

In Pictures: Houston, we have a bug - 9 famous software glitches in space

In Pictures: Houston, we have a bug - 9 famous software glitches in space

There’s never a good time to run into software bugs, but some times are worse than others - like during a mission to space. Spacecraft of all shapes and sizes rely heavily on software to complete their objectives. But those missions can be quickly ended by the simplest of human errors when writing code. The omission of an overbar here or overflow error checking code there can mean the difference between success or failure, not to mention the loss of hundreds of millions of dollars, years of work and, on manned missions, human life. Use the arrows above to read about 9 examples that show that, despite the care with which these systems are built, bugs have occurred in spacecraft software since we started to fling rockets into space - and will, no doubt, continue to crop up.

In Pictures: Houston, we have a bug - 9 famous software glitches in space
IN PICTURES: Windows 10 Sydney launch

IN PICTURES: Windows 10 Sydney launch

Tech lovers and party-goers alike headed down to Mrs Macquarie's Chair to be part of the world-first Windows 10 Launch Party. The night featured a presentation by Microsoft Australia managing director, Pip Marlow, DJs, live demonstrations and digital artistry by Lister.

IN PICTURES: Windows 10 Sydney launch

iasset.com is a channel management ecosystem that automates all major aspects of the entire sales, marketing and service process, including data tracking, integrated learning, knowledge management and product lifecycle management.

Show Comments