CVSS: 9.3EPSS: 0%CPEs: 6EXPL: 0CVE-2018-16118
https://notcve.org/view.php?id=CVE-2018-16118
A shell escape vulnerability in /webconsole/APIController in the API Configuration component of Sophos XG firewall 17.0.8 MR-8 allows remote attackers to execute arbitrary OS commands via shell metachracters in the "X-Forwarded-for" HTTP header. Una vulnerabilidad de escape de shell en /webconsole/APIController en el componente Configuration API Sophos XG firewall versión 17.0.8 MR-8, permite a los atacantes remotos ejecutar comandos arbitrarios del sistema operativo por medio de meta caracteres shell en el encabezado HTTP "X-Forwarded-for". • https://community.sophos.com/kb/en-us/132637 https://github.com/klsecservices/Advisories/blob/master/KL-SOPHOS-2018-003.md https://www.sophos.com/en-us/legal/sophos-responsible-disclosure-policy.aspx • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-17023
https://notcve.org/view.php?id=CVE-2017-17023
The Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e.com). The affected client software, "Sophos IPSec Client" 11.04 is a rebranded version of NCP "Secure Entry Client" 10.11 r32792. A vulnerability in the software update feature of the VPN client allows a man-in-the-middle (MITM) or man-on-the-side (MOTS) attacker to execute arbitrary, malicious software on a target user's computer. This is related to SIC_V11.04-64.exe (Sophos), NCP_EntryCl_Windows_x86_1004_31799.exe (NCP), and ncpmon.exe (both Sophos and NCP). The vulnerability exists because: (1) the VPN client requests update metadata over an insecure HTTP connection; and (2) the client software does not check if the software update is signed before running it. • https://www.ncp-e.com/en/resources/download-vpn-client/#c8680 https://www.ncp-e.com/fileadmin/pdf/service_support/release_notes/NCP_Secure_Clients/NCP_Secure_Entry_Client/NCP_RN_Win_Secure_Entry_Client_11_14_r42039_en.pdf • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 1CVE-2018-3971
https://notcve.org/view.php?id=CVE-2018-3971
An exploitable arbitrary write vulnerability exists in the 0x2222CC IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the driver to write data under controlled by an attacker address, resulting in memory corruption. An attacker can send IRP request to trigger this vulnerability. Existe una vulnerabilidad explotable de escritura arbitraria en la funcionalidad de manejo de llamadas IOCTL 0x2222CC de Sophos HitmanPro.Alert 3.7.6.744. Una petición IRP especialmente manipulada puede provocar que el controlador escriba datos en una dirección controlada por un atacante, lo que resulta en una corrupción de memoria. • http://www.securityfocus.com/bid/105743 https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0636 • CWE-123: Write-what-where Condition •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-3970
https://notcve.org/view.php?id=CVE-2018-3970
An exploitable memory disclosure vulnerability exists in the 0x222000 IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the driver to return uninitialized memory, resulting in kernel memory disclosure. An attacker can send an IRP request to trigger this vulnerability. Existe una vulnerabilidad explotable de divulgación de memoria en la funcionalidad de manejo de llamadas IOCTL 0x222000 de Sophos HitmanPro.Alert 3.7.6.744. Una petición IRP especialmente manipulada puede provocar que el controlador devuelva memoria no inicializada, lo que resulta en la divulgación de la memoria del kernel. • http://www.securityfocus.com/bid/105743 https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0635 • CWE-908: Use of Uninitialized Resource •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 1CVE-2018-6857
https://notcve.org/view.php?id=CVE-2018-6857
Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x802022E0. By crafting an input buffer we can control the execution path to the point where the constant 0x12 will be written to a user-controlled address. We can take advantage of this condition to modify the SEP_TOKEN_PRIVILEGES structure of the Token object belonging to the exploit process and grant SE_DEBUG_NAME privilege. This allows the exploit process to interact with higher privileged processes running as SYSTEM and execute code in their security context. Sophos SafeGuard Enterprise en versiones anteriores a la 8.00.5, SafeGuard Easy en versiones anteriores a la 7.00.3, y SafeGuard LAN Crypt en versiones anteriores a la 3.95.2 son vulnerables a una escalada de privilegios local mediante IOCTL 0x802022E0. • http://seclists.org/fulldisclosure/2018/Jul/20 https://community.sophos.com/kb/en-us/131934 https://labs.nettitude.com/blog/cve-2018-6851-to-cve-2018-6857-sophos-privilege-escalation-vulnerabilities • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •