Symantec pcAnywhere Service Unrestricted Access

critical Nessus Plugin ID 10798

Synopsis

The remote access service on this port allows unrestricted access.

Description

The pcAnywhere service does not require a password to access the desktop of this system. If this machine is running Windows 95, 98, or ME, gaining full control of the machine is trivial. If this system is running NT or 2000 and is currently logged out, an attacker can still spy on and hijack a legitimate user's session when they login.

Solution

1. Open the PC Anywhere application as an Administrator. 2. Right click on the Host object you are using and select Properties.
3. Select the Caller Access tab. 4. Switch the authentication type to Windows or PC Anywhere.
5. If you are using PC Anywhere authentication, set a strong password.

Plugin Details

Severity: Critical

ID: 10798

File Name: DDI_Unprotected_PCanywhere.nasl

Version: 1.28

Type: remote

Agent: windows

Family: Windows

Published: 11/7/2001

Updated: 6/1/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Exploitable With

Metasploit (SNMP Community Scanner)

Reference Information

CVE: CVE-1999-0508

Detections

Analytics