CVE-2009-0538 : Format string vulnerability in Symantec pcAnywhere before 12.5 SP1 allows local users to read and modify arbitrary memor

Format string vulnerability in Symantec pcAnywhere before 12.5 SP1 allows local users to read and modify arbitrary memory locations, and cause a denial of service (application crash) or possibly have unspecified other impact, via format string specifiers in the pathname of a remote control file (aka .CHF file).

Published 2009-03-18 15:30:00

Updated 2018-10-11 21:01:56

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowDenial of service

Products affected by CVE-2009-0538

Symantec » Pcanywhere
Versions up to, including, (<=) 12.5
cpe:2.3:a:symantec:pcanywhere:*:*:*:*:*:*:*:*
Matching versions
Symantec » Pcanywhere » Version: 10.0
cpe:2.3:a:symantec:pcanywhere:10.0:*:*:*:*:*:*:*
Matching versions
Symantec » Pcanywhere » Version: 10.5
cpe:2.3:a:symantec:pcanywhere:10.5:*:*:*:*:*:*:*
Matching versions
Symantec » Pcanywhere » Version: 11.0
cpe:2.3:a:symantec:pcanywhere:11.0:*:*:*:*:*:*:*
Matching versions
Symantec » Pcanywhere » Version: 11.0.1
cpe:2.3:a:symantec:pcanywhere:11.0.1:*:*:*:*:*:*:*
Matching versions
Symantec » Pcanywhere » Version: 11.5
cpe:2.3:a:symantec:pcanywhere:11.5:*:*:*:*:*:*:*
Matching versions
Symantec » Pcanywhere » Version: 11.5.1
cpe:2.3:a:symantec:pcanywhere:11.5.1:*:*:*:*:*:*:*
Matching versions
Symantec » Pcanywhere » Version: 12.0
cpe:2.3:a:symantec:pcanywhere:12.0:*:*:*:*:*:*:*
Matching versions
Symantec » Pcanywhere » Version: 12.1
cpe:2.3:a:symantec:pcanywhere:12.1:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2009-0538

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 14 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2009-0538

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2009-0538

CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2009-0538

Jump to

Vulnerability Details : CVE-2009-0538

Products affected by CVE-2009-0538

Exploit prediction scoring system (EPSS) score for CVE-2009-0538

CVSS scores for CVE-2009-0538

CWE ids for CVE-2009-0538

References for CVE-2009-0538