CVE-2010-5249: Medium severity sophos safeguard privatecrypto vulnerability

Published Sep 7, 2012

Updated

Untrusted search path vulnerability in Sophos Free Encryption 2.40.1.1 and Sophos SafeGuard PrivateCrypto 2.40.1.2 allows local users to gain privileges via a Trojan horse pcrypt0406.dll file in the current working directory, as demonstrated by a directory that contains a .uti file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Affected Software

2 affected components

Sophos SafeGuard PrivateCrypto=2.40.1.2

Sophos Free Encryption=2.40.1.1

Event History

Sep 7, 2012

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2010-5249?

The severity of CVE-2010-5249 is considered to be high due to the potential for local privilege escalation.

How do I fix CVE-2010-5249?

To fix CVE-2010-5249, update to the latest versions of Sophos Free Encryption and Sophos SafeGuard PrivateCrypto that are not affected.

Who is affected by CVE-2010-5249?

CVE-2010-5249 affects users of Sophos Free Encryption version 2.40.1.1 and Sophos SafeGuard PrivateCrypto version 2.40.1.2.

What type of vulnerability is CVE-2010-5249?

CVE-2010-5249 is an untrusted search path vulnerability that allows local users to execute malicious DLLs.

Can CVE-2010-5249 be exploited remotely?

CVE-2010-5249 cannot be exploited remotely as it requires local user access to the affected software.