PT-2017-17738 · Sophos · Sophos Surfright Hitmanpro

Published 2017-09-13 · Updated 2017-09-26 · CVE-2017-7441

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sophos SurfRight HitmanPro versions prior to 3.7.20 Build 286

Description A crafted IOCTL with code 0x22E1C0 might lead to kernel data leaks in Sophos SurfRight HitmanPro. This issue occurs at the driver level, allowing an attacker to leak critical information about the machine, such as nt!ExpPoolQuotaCookie.

Recommendations For versions prior to 3.7.20 Build 286, update to version 3.7.20 Build 286 or later to resolve the issue. As a temporary workaround, consider restricting access to the IOCTL with code 0x22E1C0 to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-7441

Affected Products

Sophos Surfright Hitmanpro

References · 4

• 🔥 https://trackwatch.com/kernel-pool-overflow-exploitation-in-real-world-windows-10 · Exploit
• https://osv.dev/vulnerability/CVE-2017-7441 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7441 · Security Note
• https://nuitduhack.com/fr/planning/talk_10 · Note