CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-6007
https://notcve.org/view.php?id=CVE-2017-6007
A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean) allows local users to crash the OS via a malformed IOCTL call. Un desbordamiento de espacio de memoria del kernel en el controlador hitmanpro37.sys en Sophos SurfRight HitmanPro en versiones anteriores a la 3.7.20 Build 286 (incluido en la solución HitmanPro.Alert y Sophos Clean) permite que usuarios remotos provoquen el cierre inesperado del sistema operativo mediante una llamada IOCTL mal formada. • https://trackwatch.com/kernel-pool-overflow-exploitation-in-real-world-windows-7 https://www.nuitduhack.com/fr/planning/talk_10 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 4CVE-2017-6008 – HitmanPro 3.7.15 Build 281 - Kernel Pool Overflow
https://notcve.org/view.php?id=CVE-2017-6008
A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean) allows local users to escalate privileges via a malformed IOCTL call. Un desbordamiento de espacio de memoria del kernel en el controlador hitmanpro37.sys en Sophos SurfRight HitmanPro en versiones anteriores a la 3.7.20 Build 286 (incluido en la solución HitmanPro.Alert y Sophos Clean) permite que usuarios remotos escalen privilegios mediante una llamada IOCTL mal formada. • https://www.exploit-db.com/exploits/43057 https://github.com/cbayet/Exploit-CVE-2017-6008 https://trackwatch.com/kernel-pool-overflow-exploitation-in-real-world-windows-10 https://trackwatch.com/kernel-pool-overflow-exploitation-in-real-world-windows-7 https://www.nuitduhack.com/fr/planning/talk_10 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7441
https://notcve.org/view.php?id=CVE-2017-7441
In Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean), a crafted IOCTL with code 0x22E1C0 might lead to kernel data leaks. Because the leak occurs at the driver level, an attacker can use this vulnerability to leak some critical information about the machine such as nt!ExpPoolQuotaCookie. En Sophos SurfRight HitmanPro en versiones anteriores a 3.7.20 Build 286 (incluido en la solución HitmanPro.Alert y Sophos Clean), un IOCTL manipulado con código 0x22E1C0 podría conducir a fugas de datos del kernel. Debido a que la fuga ocurre a nivel de controlador, un atacante puede emplear esta vulnerabilidad para filtrar información crítica sobre la máquina, como por ejemplo nt! • https://trackwatch.com/kernel-pool-overflow-exploitation-in-real-world-windows-10 https://www.nuitduhack.com/fr/planning/talk_10 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •