CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 1CVE-2018-6857
https://notcve.org/view.php?id=CVE-2018-6857
Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x802022E0. By crafting an input buffer we can control the execution path to the point where the constant 0x12 will be written to a user-controlled address. We can take advantage of this condition to modify the SEP_TOKEN_PRIVILEGES structure of the Token object belonging to the exploit process and grant SE_DEBUG_NAME privilege. This allows the exploit process to interact with higher privileged processes running as SYSTEM and execute code in their security context. Sophos SafeGuard Enterprise en versiones anteriores a la 8.00.5, SafeGuard Easy en versiones anteriores a la 7.00.3, y SafeGuard LAN Crypt en versiones anteriores a la 3.95.2 son vulnerables a una escalada de privilegios local mediante IOCTL 0x802022E0. • http://seclists.org/fulldisclosure/2018/Jul/20 https://community.sophos.com/kb/en-us/131934 https://labs.nettitude.com/blog/cve-2018-6851-to-cve-2018-6857-sophos-privilege-escalation-vulnerabilities • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 1CVE-2018-6854
https://notcve.org/view.php?id=CVE-2018-6854
Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via multiple IOCTLs, e.g., 0x8810200B, 0x8810200F, 0x8810201B, 0x8810201F, 0x8810202B, 0x8810202F, 0x8810203F, 0x8810204B, 0x88102003, 0x88102007, 0x88102013, 0x88102017, 0x88102027, 0x88102033, 0x88102037, 0x88102043, and 0x88102047. When some conditions in the user-controlled input buffer are not met, the driver writes an error code (0x2000001A) to a user-controlled address. Also, note that all the aforementioned IOCTLs use transfer type METHOD_NEITHER, which means that the I/O manager does not validate any of the supplied pointers and buffer sizes. So, even though the driver checks for input/output buffer sizes, it doesn't validate if the pointers to those buffers are actually valid. So, we can supply a pointer for the output buffer to a kernel address space address, and the error code will be written there. • http://seclists.org/fulldisclosure/2018/Jul/20 https://community.sophos.com/kb/en-us/131934 https://labs.nettitude.com/blog/cve-2018-6851-to-cve-2018-6857-sophos-privilege-escalation-vulnerabilities • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 1CVE-2018-6851
https://notcve.org/view.php?id=CVE-2018-6851
Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x80206040. By crafting an input buffer we can control the execution path to the point where the constant DWORD 0 will be written to a user-controlled address. We can take advantage of this condition to zero-out the pointer to the security descriptor in the object header of a privileged process or modify the security descriptor itself and run code in the context of a process running as SYSTEM. Sophos SafeGuard Enterprise en versiones anteriores a la 8.00.5, SafeGuard Easy en versiones anteriores a la 7.00.3, y SafeGuard LAN Crypt en versiones anteriores a la 3.95.2 son vulnerables a una escalada de privilegios local mediante IOCTL 0x80206040. Manipulando un búfer de entrada, es posible controlar la ruta de ejecución al punto en el que la constante DWORD 0 se escribirá en una dirección controlada por el usuario. • http://seclists.org/fulldisclosure/2018/Jul/20 https://community.sophos.com/kb/en-us/131934 https://labs.nettitude.com/blog/cve-2018-6851-to-cve-2018-6857-sophos-privilege-escalation-vulnerabilities • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 1CVE-2018-6855
https://notcve.org/view.php?id=CVE-2018-6855
Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x80202014. By crafting an input buffer we can control the execution path to the point where the constant 0xFFFFFFF will be written to a user-controlled address. We can take advantage of this condition to modify the SEP_TOKEN_PRIVILEGES structure of the Token object belonging to the exploit process and grant SE_DEBUG_NAME privilege. This allows the exploit process to interact with higher privileged processes running as SYSTEM and execute code in their security context. Sophos SafeGuard Enterprise en versiones anteriores a la 8.00.5, SafeGuard Easy en versiones anteriores a la 7.00.3, y SafeGuard LAN Crypt en versiones anteriores a la 3.95.2 son vulnerables a una escalada de privilegios local mediante IOCTL 0x80202014. • http://seclists.org/fulldisclosure/2018/Jul/20 https://community.sophos.com/kb/en-us/131934 https://labs.nettitude.com/blog/cve-2018-6851-to-cve-2018-6857-sophos-privilege-escalation-vulnerabilities • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 1CVE-2018-6853
https://notcve.org/view.php?id=CVE-2018-6853
Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x80206024. By crafting an input buffer we can control the execution path to the point where a global variable will be written to a user controlled address. We can take advantage of this condition to zero-out the pointer to the security descriptor in the object header of a privileged process or modify the security descriptor itself and run code in the context of a process running as SYSTEM. Sophos SafeGuard Enterprise en versiones anteriores a la 8.00.5, SafeGuard Easy en versiones anteriores a la 7.00.3, y SafeGuard LAN Crypt en versiones anteriores a la 3.95.2 son vulnerables a una escalada de privilegios local mediante IOCTL 0x80206024. Manipulando un búfer de entrada, es posible controlar la ruta de ejecución al puntero, en el que se escribirá una variable global en una dirección controlada por el usuario. • http://seclists.org/fulldisclosure/2018/Jul/20 https://community.sophos.com/kb/en-us/131934 https://labs.nettitude.com/blog/cve-2018-6851-to-cve-2018-6857-sophos-privilege-escalation-vulnerabilities • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •