CVE-2011-3478
Symantec pcAnywhere 12.5.x-12.5.3 & IT Management Suite 7.0-7.1 - RCE via TCP Port 5631
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2011-3478. PoCs published by Tomislav Paskalev, S2 Crew.
AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in Symantec pcAnywhere v12.5.0 (CVE-2011-3478) to achieve remote code execution. It leverages a fixed-length buffer overflow in the authentication process of awhost32.exe, allowing arbitrary code execution with SYSTEM privileges.
Description
The host-services component in Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), does not properly filter login and authentication data, which allows remote attackers to execute arbitrary code via a crafted session on TCP port 5631.
Exploits (2)
This exploit targets a buffer overflow vulnerability in Symantec pcAnywhere v12.5.0 (CVE-2011-3478) to achieve remote code execution. It leverages a fixed-length buffer overflow in the authentication process of awhost32.exe, allowing arbitrary code execution with SYSTEM privileges.
This exploit targets a buffer overflow vulnerability in Symantec PcAnywhere 12.5.0 by sending maliciously crafted packets to trigger a crash and potentially execute shellcode. The PoC includes a hardcoded IP address and shellcode for demonstration purposes.