RETIRED: Symantec pcAnywhere CIF Files Local Privilege Escalation Vulnerability

Bugtraq ID:	19059
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Jul 18 2006 12:00AM
Updated:	Jul 13 2007 10:56PM
Credit:	zee is credited with discovering this vulnerability.
Vulnerable:	Symantec pcAnywhere 12.5
Not Vulnerable:

RETIRED: Symantec pcAnywhere CIF Files Local Privilege Escalation Vulnerability

pcAnywhere is prone to a local privilege-escalation vulnerability because it fails to secure access to important user-permission configuration files.

A successful exploit of this vulnerability may allow an attacker to remotely access the system with administrator credentials.

pcAnywhere 12.5 is vulnerable to this issue; other versions may also be affected.

RETIRED: This BID is being retired because further investigation indicates that the application is not vulnerable to this issue.

RETIRED: Symantec pcAnywhere CIF Files Local Privilege Escalation Vulnerability

An attacker may exploit this vulnerability by gaining local access to a computer and stealing the CIF files.

RETIRED: Symantec pcAnywhere CIF Files Local Privilege Escalation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

RETIRED: Symantec pcAnywhere CIF Files Local Privilege Escalation Vulnerability

References:

• Digital Bullets (zee)
  
• PcAnywhere > 12 Local Privilege Escalation (zee)