In the round file cabinet goes; PCAnywhere

Critical flaw discovered in Symantec’s pcAnywhere

Symantec has issued a warning about a critical vulnerability in pcAnywhere, the remote control application for PCs. The vulnerability could allow an attacker to remotely inject code into a system running pcAnywhere and then run it with system privileges. This attack works because a service on TCP port 5631 allows user input during the authentication process which is not adequately checked.

Image via CrunchBase

According to Symantec, this port should, under normal conditions , only be reachable by authorised network users, so an attacker would have to first gain access to the network or another computer on the network to compromise other systems. In practice though, overly lax firewall configurations mean that such ports are always available somewhere on the internet.

Symantec is also correcting a vulnerability which meant that files installed during pcAnywhere’s installation process were marked as writable by everyone. This would allow an unprivileged user with local access to overwrite these files, possibly with code which could grant elevated privileges.
LoJack for Laptops Standard, boxed software, 1 year – 20% OFF. Was $39.99 – Now $31.99 Click Here
Further details of the two holes are still being kept under wraps by Symantec and exploits are reportedly not in circulation. As the flaws were reported by security researchers Tad Seltzer (via ZDI) and Edward Torkington (of NGS Secure) it is probable that the discovery of the flaws is not related to the recent theft of source code for an older version of pcAnywhere.

pcAnywhere 12.5.x is vulnerable to the flaws, as are versions 7.0 and 7.1 of the company’s IT Management Suite Solution. Symantec has released a hotfix which can be installed either manually or automatically with Symantec’s LiveUpdate system.

Symantec has admitted that blueprints for current versions of its pcAnywhere software were stolen in 2006 and that all users are at risk of attack and should pull the plug.

That includes users of both current and past iterations as well as those bundled with Altiris and the pcAnywhere Thin Host packaged with backup and security products.

The theft came to light when an Indian hacking group calling itself the Lords of Dharmaraja threatened to publish the source code.

The gang’s apparent spokesperson, who goes by the name of “Yama Tough,” posted code from the 2006 version of Symantec’s Norton AntiVirus to PasteBin and subsequently wrote about the breach on Google+.

It was originally unclear whether the breached source code was relevant to up-to-date installations of Symantec’s anti-virus products.

The confusion has lifted, showing that the danger to users of current products is all too real.

Symantec revealed the news in a white paper[PDF] published on Wednesday, along with a customer advisory on its website.

Symantec’s investigation so far hasn’t found increased risk of exposure to customers using any product, with the marked exception of pcAnywhere, which allows for direct PC to PC communication.

Here’s what the security firm had to say about the pcAnywhere-specific risks, as paraphrased from its white paper:

• The encoding and encryption elements within pcAnywhere are vulnerable, making users susceptible to man-in-the-middle attacks, depending on the configuration and use of the product. If a man-in-the-middle attack should occur, the malicious user could steal session data or credentials.

• A secondary risk: If a malicious user obtains the cryptographic key, they can launch unauthorized remote control sessions and thus access systems and sensitive data.

• If the cryptographic key itself is using Active Directory credentials, it is also possible for attackers to perpetrate other malicious activities on the network.

• In an internal pcAnywhere environment, if a network sniffer was in place on a customer’s internal network and the attacker had access to the encryption details, the pcAnywhere traffic could be intercepted and decoded. This implies that a customer either has a malicious insider who planted the network sniffer or has an unknown Botnet operating in their environment. As always, security best practices are encouraged to mitigate this risk.

• Since pcAnywhere exchanges user login credentials, the risk exists that a network sniffer or Botnet could intercept this exchange of information, though it would still be difficult to actually interpret the data even if the pcAnywhere source code is released.

• For environments with remote users, this credential exchange introduces an additional level of exposure to external attacks.

Company spokesman Cris Paden told Reuters that Symantec has fewer than 50,000 customers using the stand-alone version of pcAnywhere, which, Reuters reported, was still on sale on its website for $100 and $200 as of early Wednesday afternoon.

Symantec recommends in the white paper that customers disable the product until the company can release a set of updates to deal with the currently known vulnerability risks.

Related articles

• Symantec: Anonymous stole source code, users should disable pcAnywhere (arstechnica.com)
• Symantec pcAnyware is not safe to use for now, says company (news.consumerreports.org)
• PSA: Disable your Symantec pcAnywhere software ASAP (slashgear.com)

January 25, 2012 | Categories: Anonymous, Enterprise, General Security, Malware, Network Security, Patching, PCAnywhere, Security, Security Advisory, source code, Vulnerabilities, Wireless Security, Zero-Day | Tags: Altiris, critical vulnerability, CrunchBase, firewall configurations, NGS Secure, Norton AntiVirus, Norton Internet Security, PasteBin, PcAnywhere, pcanywhere symantec, Personal computer, Security, Source code, source code users, Symantec, symantec pcanywhere, system privileges, Transmission Control Protocol, Vulnerability (computing) | 2 Comments