Authentication Bypass in Symantec pcAnywhere and IT Management Suite
CVE-2011-3478

Currently unrated

Key Information:

Vendor

Symantec
Status
Pcanywhere
Vendor
CVE Published:
25 January 2012

What is CVE-2011-3478?

The host-services component in Symantec pcAnywhere versions 12.5.x through 12.5.3 and IT Management Suite pcAnywhere Solution versions 7.0 and 7.1 fails to adequately validate login and authentication data. This flaw enables remote attackers to craft malicious sessions over TCP port 5631, potentially allowing them to execute arbitrary code within the affected system, leading to unauthorized access and control over sensitive information.

References

http://osvdb.org/show/osvdb/78532
vdb-entryx_refsource_OSVDB
https://www.exploit-db.com/exploits/38599/
exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/51592
vdb-entryx_refsource_BID

EPSS Score

58% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.