{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-03-17T00:00:00", "descriptions": [{"lang": "en", "value": "Format string vulnerability in Symantec pcAnywhere before 12.5 SP1 allows local users to read and modify arbitrary memory locations, and cause a denial of service (application crash) or possibly have unspecified other impact, via format string specifiers in the pathname of a remote control file (aka .CHF file)."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-11T19:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://securityresponse.symantec.com/avcenter/security/Content/2009.03.17.html"}, {"name": "33845", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/33845"}, {"name": "34305", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/34305"}, {"name": "1021855", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1021855"}, {"name": "symantec-pcanywhere-unspecified-dos(49291)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49291"}, {"name": "52797", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/52797"}, {"name": "ADV-2009-0755", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2009/0755"}, {"name": "20090318 Layered Defense Research Advisory: Format String Vulnerablity in Symantec PcAnywhere v10-12.5", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/501930/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "http://www.layereddefense.com/pcanywhere17mar.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-0538", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Format string vulnerability in Symantec pcAnywhere before 12.5 SP1 allows local users to read and modify arbitrary memory locations, and cause a denial of service (application crash) or possibly have unspecified other impact, via format string specifiers in the pathname of a remote control file (aka .CHF file)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://securityresponse.symantec.com/avcenter/security/Content/2009.03.17.html", "refsource": "CONFIRM", "url": "http://securityresponse.symantec.com/avcenter/security/Content/2009.03.17.html"}, {"name": "33845", "refsource": "BID", "url": "http://www.securityfocus.com/bid/33845"}, {"name": "34305", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/34305"}, {"name": "1021855", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1021855"}, {"name": "symantec-pcanywhere-unspecified-dos(49291)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49291"}, {"name": "52797", "refsource": "OSVDB", "url": "http://osvdb.org/52797"}, {"name": "ADV-2009-0755", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2009/0755"}, {"name": "20090318 Layered Defense Research Advisory: Format String Vulnerablity in Symantec PcAnywhere v10-12.5", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/501930/100/0/threaded"}, {"name": "http://www.layereddefense.com/pcanywhere17mar.html", "refsource": "MISC", "url": "http://www.layereddefense.com/pcanywhere17mar.html"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-0538", "datePublished": "2009-03-18T15:00:00", "dateReserved": "2009-02-12T00:00:00", "dateUpdated": "2018-10-11T19:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:symantec:pcanywhere:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B5D2349-8330-4DE8-8040-6FDD368EFD32", "versionEndIncluding": "12.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:pcanywhere:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "5DAB70F5-1B1B-426B-A1F9-6D91D0A160B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:pcanywhere:10.5:*:*:*:*:*:*:*", "matchCriteriaId": "9F0A6A97-1EFF-41C0-AAAA-B357C4C801F4", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:pcanywhere:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "014AA70B-942F-4ADE-9EEF-4F5204438268", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:pcanywhere:11.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "D0BF0A19-0AAD-44B2-9B51-85A985CC40A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:pcanywhere:11.5:*:*:*:*:*:*:*", "matchCriteriaId": "A496D973-4BC8-4377-8C84-8F2CB281AEE1", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:pcanywhere:11.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "3FF752E6-45B4-4D6D-90F8-AA69DB5C2775", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:pcanywhere:12.0:*:*:*:*:*:*:*", "matchCriteriaId": "B13E1710-1723-4A52-ACDC-7FC511467152", "vulnerable": true}, {"criteria": "cpe:2.3:a:symantec:pcanywhere:12.1:*:*:*:*:*:*:*", "matchCriteriaId": "ECE0E3DD-23F9-4ACD-BF9D-986CE5232D4E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Format string vulnerability in Symantec pcAnywhere before 12.5 SP1 allows local users to read and modify arbitrary memory locations, and cause a denial of service (application crash) or possibly have unspecified other impact, via format string specifiers in the pathname of a remote control file (aka .CHF file)."}, {"lang": "es", "value": "Una vulnerabilidad de formato de cadena en Symantec pcAnywhere antes de 12.5 SP1 permite a atacantes remotos leer y modificar localizaciones de memoria de su elecci\u00f3n y producir una denegaci\u00f3n de servicio (ca\u00edda de la aplicaci\u00f3n) o posiblemente tener otro efecto no especificado mediante especificadores de cadena de formato en el nombre de ruta de fichero de un fichero de control remoto (alias fichero .CHF)."}], "id": "CVE-2009-0538", "lastModified": "2018-10-11T21:01:55.730", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-03-18T15:30:00.453", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/52797"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/34305"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://securityresponse.symantec.com/avcenter/security/Content/2009.03.17.html"}, {"source": "cve@mitre.org", "url": "http://securitytracker.com/id?1021855"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.layereddefense.com/pcanywhere17mar.html"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/501930/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/33845"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2009/0755"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49291"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-134"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}