Secunia

Luigi Auriemma and Patrick have reported some vulnerabilities in RemotelyAnywhere, which can be exploited by malicious people to conduct cross-site scripting attacks or to cause a DoS (Denial of Service).

1) A NULL-pointer dereference error within the RemotelyAnywhere.exe service can be exploited to crash the service via a HTTP request with a specially crafted Accept-Charset header. The service is restarted after a few seconds.

2) Input passed via the URL to the web interface is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in RemotelyAnywhere Server and Workstation version 8.0.668. Other versions may also be affected.

Solution
Restrict network access to the service.
Further details available in Customer Area

Provided and/or discovered by
1) Luigi Auriemma
2) Patrick

Changelog
Further details available in Customer Area

Original Advisory
http://aluigi.altervista.org/adv/remotelynowhere-adv.txt

Deep Links
Links available in Customer Area