L-055: pcAnywhere Denial of Service, abnormal server connection

PROBLEM:       A software error exists in the Symantec pcAnywhere remote
               control solution. 
PLATFORM:      pcAnywhere v 9.x and 10.x 
DAMAGE:        An abnormal number of random characters sent to the port,
               immediately upon connection, causes communications to fail.
               The server has to be restarted to clear the port. The result is
               an immediate denial of service (DoS) to the affected server.  The
               vulnerability has the potential to allow an intruder to run
               programs on a system.
SOLUTION:      Immediately apply the patch as directed by the security alert.
VULNERABILITY  The risk is MEDIUM.  A buffer overflow capability was publicly
ASSESSMENT:    announced. 


Background

CIAC received notice that a possible buffer overflow condition existed in
pcAnywhere, version 9.0, via use of a public script.  CIAC tested the script and
found that a communications lockup was created by use of the script.  CIAC
notified Symantec of the finding and how CIAC created the condition.

The notice also mentioned that this vulnerability is being examined to see if
it can be exploited remotely to run user programs on a system.

CIAC wishes to thank Symantec for its excellent response & communications in
resolving this security issue.

[******  Begin Symantec Security Alert ******]

SARC Security Alert
DTD:  05 March, 2001

Subject: 
pcAnywhere Denial of Service, abnormal server connection

Affected: 
pcAnywhere v9.2x and v10.0

Problem: 

A Denial of Service condition exists in the Symantec pcAnywhere remote
control solution that can result in the pcAnywhere server becoming unable
to accept remote connections.

Details: 

When the socket upon which the pcAnywhere server is listening is fed an
abnormal amount of random characters immediately upon connection, any
further communications between any pcAnywhere client and the server is
prevented.  The server indicates continuing to listen for a connection but
no longer accepts client connections until the server application is
restarted.

Risk Impact: 

Low Risk, prevents remote administration of affected host until pcAnywhere
server application is restarted.

Solution: 

Symantec has developed fixes for pcAnywhere v 9.x and 10.x for this issue.
Patches have been  posted to the following location for download and are to
be included in the pcAnywhere LiveUpdate the week of 5-9 March:

     pcA 9.x
     http://www.symantec.com/techsupp/files/pca/pca9-9598nt.html

     pcA 10.x
     http://www.symantec.com/techsupp/files/pca/pca_10.html

Alert Location: 
This Security Alert can be viewed at
http://service1.symantec.com/sarc/sarc.nsf/info/html/pcAnywhere.Denial.of.Service.html

Credit:  Symantec wishes to thank the engineers at the Computer Incident
Advisory Capability (CIAC), Lawrence Livermore National Labs for their
excellent coordination in helping resolve this issue.
Copyright (c) 2001 by Symantec Corp.

Permission to redistribute this Bulletin electronically is granted as long
as it is not edited in any way unless authorized by the SARC. Reprinting
the whole or part of this Bulletin in medium other than electronically
requires permission from Sym Security@symantec.com.

Disclaimer: 

The information in the advisory is believed to be accurate at the time of
printing based on currently available information. Use of the information
constitutes acceptance for use in an AS IS condition. There are no
warranties with regard to this information. Neither the author nor the
publisher accepts any liability for any direct, indirect or consequential
loss or damage arising from use of, or reliance on this information.
Symantec, SARC and Sym Security are Registered Trademarks of Symantec Corp.
and/or affiliated companies in the United States and other countries. All
other registered and unregistered trademarks represented in this document
are the sole property of their respective companies/owners.

[******  End Symantec Security Alert ******]

    Voice:          +1 925-422-8193 (7 x 24)
    FAX:            +1 925-423-8002
    STU-III:        +1 925-423-2604
    E-mail:          ciac@ciac.org
    World Wide Web:  http://www.ciac.org/
    Anonymous FTP:   ftp.ciac.org