Symantec has warned users of its remote access tool, pcAnywhere, to disable the product until it patches vulnerabilities related to the 2006 theft of source code by hacktivist group, Anonymous.

pcAnwyhere, originally a product of Peter Norton Computing, is a tool that gives enterprise users remote access to their PCs. It is sold individually or bundled in Altiris Client Management Suite, Altiris IT Management Suite versions 7.0 or later, and Altiris Deployment Solution with Remote v7.1.

"Upon investigation of the claims made by Anonymous regarding source code disclosure, Symantec believes that the disclosure was the result of a theft of source code that occurred in 2006," the company wrote in a white paper.

"Symantec recommends disabling the product until Symantec releases a final set of software updates that resolve currently known vulnerability risks," it added. At worst, the company warned, malicious users with access to the source code can build new exploits for man-in-the-middle attacks, which can expose authentication and session information.

If customers choose to ignore the risks, Symantec recommends ensuring you have the latest version 12.5 installed. My colleague Neil Rubenking pointed out that source code for productivity tools does not necessarily change at least once a year, as it does for anti-virus products, hence there could be users running six-year-old source code.  

This is the second time in a month when a Symantec acquisition has fallen into trouble over source code theft. In early January, Symantec confirmed that source code used in its older enterprise antivirus products was stolen. Hacker group the "Lords of Dharmaraja" of India had threatened to publish the code online. Although the code dated back to 1999, security expert Alex Horan of CORE Security Technologies said there was still potential for harm. 

"Even if the anti-virus source code stolen from Symantec were several years old, it could possibly still be relevant to current software," he wrote in a blog post. "A criminal could conceivably leverage the source code to better understand how their anti-virus scanner emulates files and binaries to look for threats."