PT-2017-17738 · Sophos · Sophos Surfright Hitmanpro

Publicado 2017-09-13 · Atualizado 2017-09-26 · CVE-2017-7441

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sophos SurfRight HitmanPro versions prior to 3.7.20 Build 286

Description A crafted IOCTL with code 0x22E1C0 might lead to kernel data leaks in Sophos SurfRight HitmanPro. This issue occurs at the driver level, allowing an attacker to leak critical information about the machine, such as nt!ExpPoolQuotaCookie.

Recommendations For versions prior to 3.7.20 Build 286, update to version 3.7.20 Build 286 or later to resolve the issue. As a temporary workaround, consider restricting access to the IOCTL with code 0x22E1C0 to minimize the risk of exploitation.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-7441

Produtos afetados

Sophos Surfright Hitmanpro

Referências · 4

• 🔥 https://trackwatch.com/kernel-pool-overflow-exploitation-in-real-world-windows-10 · Exploit
• https://osv.dev/vulnerability/CVE-2017-7441 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7441 · Nota de Segurança
• https://nuitduhack.com/fr/planning/talk_10 · Nota