CVE Feed

    Dashboard / CVE / CVE-2009-0538

    CVE-2009-0538

    Format string vulnerability in Symantec pcAnywhere before 12.5 SP1 allows local users to read and modify arbitrary memory locations, and cause a denial of service (application crash) or possibly have unspecified other impact, via format string specifiers in the pathname of a remote control file (aka .CHF file).

    Published:Mar 18, 2009
    Last Modified:Apr 23, 2026
    EPS:Mar 18, 2009
    EPSS Score:0.00079
    CVSS Score:4.6

    Affected Products

    Vendor
    Symantec
    Product
    Pcanywhere

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-135 Format String Injection
    CAPEC-67 String Format Overflow in syslog()

    Related CVEs

    CVE-2012-0292 (CVSS 5) — The awhost32 service in Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.…
    CVE-2012-0291 (CVSS 5) — Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (…
    CVE-2012-0290 (CVSS 10) — Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (…
    CVE-2011-3478 (CVSS 10) — The host-services component in Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere S…
    CVE-2011-3479 (CVSS 6.8) — Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.…
    CVE-2007-2619 (CVSS 4.6) — Symantec pcAnywhere 11.5.x and 12.0.x retains unencrypted login credentials for the most recent login within p…
    CVE-2006-4855 (CVSS 4.9) — The \Device\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.0.33, and other versions of Norton P…
    CVE-2006-3784 (CVSS 7.2) — Symantec pcAnywhere 12.5 uses weak default permissions for the "Symantec\pcAnywhere\Hosts" folder, which allow…
    CVE-2006-3785 (CVSS 2.1) — Symantec pcAnywhere 12.5 obfuscates the passwords in a GUI textbox with asterisks but does not encrypt them in…
    CVE-2006-3786 (CVSS 3.6) — Symantec pcAnywhere 12.5 uses weak integrity protection for .cif (aka caller or CallerID) files, which allows …

    References

    http://osvdb.org/52797
    http://secunia.com/advisories/34305
    http://securityresponse.symantec.com/avcenter/security/Content/2009.03.17.html
    http://securitytracker.com/id?1021855
    http://www.layereddefense.com/pcanywhere17mar.html
    http://www.securityfocus.com/archive/1/501930/100/0/threaded
    http://www.securityfocus.com/bid/33845
    http://www.vupen.com/english/advisories/2009/0755
    https://exchange.xforce.ibmcloud.com/vulnerabilities/49291
    http://osvdb.org/52797
    http://secunia.com/advisories/34305
    http://securityresponse.symantec.com/avcenter/security/Content/2009.03.17.html
    http://securitytracker.com/id?1021855
    http://www.layereddefense.com/pcanywhere17mar.html
    http://www.securityfocus.com/archive/1/501930/100/0/threaded
    http://www.securityfocus.com/bid/33845
    http://www.vupen.com/english/advisories/2009/0755
    https://exchange.xforce.ibmcloud.com/vulnerabilities/49291

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High