Unscored severity · published Jan 25, 2012
CVE-2011-3478
The host-services component in Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), does not properly…
–
CVSS
39.5%
EPSS
No
On KEV
Description
The host-services component in Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), does not properly filter login and authentication data, which allows remote attackers to execute arbitrary code via a crafted session on TCP port 5631.
Exploitation
Is it being used?
Exploit prediction (EPSS)39.5% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
Pcanywhere · Symantec
12.5; 12.5; 12.5; 12.5; 12.5.539; 12.6.65; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-3478
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-3478
osvdb.org
http://osvdb.org/show/osvdb/78532
secunia.com
http://secunia.com/advisories/48092
www.securityfocus.com
http://www.securityfocus.com/bid/51592
Vendor Advisory
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120124_00
www.zerodayinitiative.com
http://www.zerodayinitiative.com/advisories/ZDI-12-018/
www.exploit-db.com
https://www.exploit-db.com/exploits/38599/
More from Pcanywhere
–
CVE-2012-0292
The awhost32 service in Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), Altiris Client Management Suite…
–
CVE-2012-0291
Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), Altiris Client Management Suite pcAnywhere Solution 7.0…
–
CVE-2012-0290
Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), Altiris Client Management Suite pcAnywhere Solution 7.0…
–
CVE-2011-3479
Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), uses world-writable permissions for…
–
CVE-2009-0538
Format string vulnerability in Symantec pcAnywhere before 12.5 SP1 allows local users to read and modify arbitrary memory locations, and cause a denial of service (application…