[ For Public Release ]
-----BEGIN PGP SIGNED MESSAGE-----

             __________________________________________________________

                       The U.S. Department of Energy
                    Computer Incident Advisory Capability
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___
             __________________________________________________________

                             INFORMATION BULLETIN

            pcAnywhere Denial of Service, abnormal server connection

March 5, 2001 22:00 GMT                                           Number L-055
______________________________________________________________________________
PROBLEM:       A software error exists in the Symantec pcAnywhere remote
               control solution.
PLATFORM:      pcAnywhere Version 9.x and 10.x 
DAMAGE:        An abnormal number of random characters sent to the pcAnywhere 
               listening port, immediately upon connection, causes 
               communications to fail. The server has to be restarted to clear 
               the port. The result is an immediate denial of service (DoS) to 
               the affected server.  The vulnerability has the potential to
               allow an intruder to run programs on a system.
SOLUTION:      Apply the patches as directed by the security alert. 
______________________________________________________________________________
VULNERABILITY  The risk is MEDIUM. A buffer overflow capability was publicly 
ASSESSMENT:    announced.
______________________________________________________________________________

Background

CIAC received notice that a possible buffer overflow condition existed in
pcAnywhere, version 9.0, via use of a public script.  CIAC tested the script and
found that a communications lockup was created by use of the script.  CIAC
notified Symantec of the finding and how CIAC created the condition.

The notice also mentioned that this vulnerability is being examined to see if
it can be exploited remotely to run user programs on a system.

CIAC wishes to thank Symantec for its excellent response & communications in
resolving this security issue.

[******  Begin Symantec Security Alert ******]

http://www.ciac.org/ciac/bulletins/l-055.shtml

[******  End Symantec Security Alert ******]

-----BEGIN PGP SIGNATURE-----
Version: 4.0 Business Edition

iQCVAwUBOqUUm7nzJzdsy3QZAQHIoAQAxCsAWwmSHWJlx2FmLLXwhfa68dcfk4/H
hrRsRXV2CZZmgo9ZSI4Wle4M75VjQ4xqxl22dFwLngkrVqEXJyz5NB9/2y/nvvWe
GWPsQENEwVX1ZprJywvOS8mL8l0dsbxwsTBU3qwi3scmoyaRGAaMt4BLL2kstpcL
th0vclSiwQM=
=W3b1
-----END PGP SIGNATURE-----

-+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+
This message was posted through the FIRST mailing list server.  If you
wish to unsubscribe from this mailing list, send the message body of
"unsubscribe first-info" to first-majordomo@FIRST.ORG
-+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+