CVE-2014-1213

Severity Score

5.6

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11, and 10.3.x before 10.3.1 does not set an ACL for certain global and session objects, which allows local users to bypass anti-virus protection, cause a denial of service (resource consumption, CPU consumption, and eventual crash) or spoof "ready for update" messages by performing certain operations on mutexes or events including (1) DataUpdateRequest, (2) MmfMutexSAV-****, (3) MmfMutexSAV-Info, (4) ReadyForUpdateSAV-****, (5) ReadyForUpdateSAV-Info, (6) SAV-****, (7) SAV-Info, (8) StateChange, (9) SuspendedSAV-****, (10) SuspendedSAV-Info, (11) UpdateComplete, (12) UpdateMutex, (13) UpdateRequest, or (14) SophosALMonSessionInstance, as demonstrated by triggering a ReadyForUpdateSAV event and modifying the UpdateComplete, UpdateMutex, and UpdateRequest objects.

El motor de Sophos Anti-Virus (SAVi) anterior a 3.50.1, utilizado en VDL 4.97G 9.7.x anterior a 9.7.9, 10.0.x anterior a 10.0.11 y 10.3.x anterior a 10.3.1 no establece una ACL para cietos objetos globales y de sesión, lo que permite a usuarios locales evadir la protección Anti-Virus, causa una denegación de servicio (consumo de recursos, consumo de CPU y finalmente una caída) o falsifica mensajes de "preparado para actualización" mediante ciertas operaciones realizadas en mutexes o eventos incluyendo (1) DataUpdateRequest, (2) MmfMutexSAV-****, (3) MmfMutexSAV-Info, (4) ReadyForUpdateSAV-****, (5) ReadyForUpdateSAV-Info, (6) SAV-****, (7) SAV-Info, (8) StateChange, (9) SuspendedSAV-****, (10) SuspendedSAV-Info, (11) UpdateComplete, (12) UpdateMutex, (13) UpdateRequest o (14) SophosALMonSessionInstance, demostrado mediante la provocación de un evento ReadyForUpdateSAV y modificación de objetos UpdateComplete, UpdateMutex y UpdateRequest.

*Credits: N/A

CVSS Scores

NISTv2 5.6

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2014-01-07 CVE Reserved
2014-02-02 CVE Published
2024-08-06 CVE Updated
2024-08-28 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (8)

URL	Tag	Source
http://osvdb.org/102762	Vdb Entry
http://packetstormsecurity.com/files/125024/Sophos-Anti-Virus-Denial-Of-Service.html	X_refsource_misc
http://seclists.org/fulldisclosure/2014/Feb/1	Mailing List
http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1213	X_refsource_misc
http://www.securityfocus.com/archive/1/530915/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/65286	Vdb Entry
http://www.securitytracker.com/id/1029713	Vdb Entry
http://www.sophos.com/en-us/support/knowledgebase/2300/7200/1031/120401.aspx	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Sophos Search vendor "Sophos"		Scanning Engine Search vendor "Sophos" for product "Scanning Engine"				<= 3.48 Search vendor "Sophos" for product "Scanning Engine" and version " <= 3.48"		-		Affected
Sophos Search vendor "Sophos"		Sophos Anti-virus Search vendor "Sophos" for product "Sophos Anti-virus"				10.0.11 Search vendor "Sophos" for product "Sophos Anti-virus" and version "10.0.11"		-		Affected