Symantec pcAnywhere Remote Attack Code Surfaces

Code has been published that attackers could use to crash fully patched versions of pcAnywhere on any Windows PC, without first having to authenticate to the PC.

The exploit details arrived Friday in the form of a Pastebin post from Johnathan Norman, director of security research at Alert Logic. Advertised as a "PCAnywhere Nuke," the Python code can be used to create a denial of service (DoS) by crashing "the ashost32 service," he said in the post. "It'll be respawned so if you want to be a real pain you'll need to loop this...my initial impressions are that controlling execution will be a pain." He said the exploit works even against the most recent, fully patched version of pcAnywhere (version 12.5.0 build 463 and earlier).

"Symantec is aware of the posting and is investigating the claims," said Symantec spokeswoman Katherine James via email. "We have no additional information to provide at this time."