CVE-2014-1213
First published: Mon Feb 10 2014(Updated: )
Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11, and 10.3.x before 10.3.1 does not set an ACL for certain global and session objects, which allows local users to bypass anti-virus protection, cause a denial of service (resource consumption, CPU consumption, and eventual crash) or spoof "ready for update" messages by performing certain operations on mutexes or events including (1) DataUpdateRequest, (2) MmfMutexSAV-****, (3) MmfMutexSAV-Info, (4) ReadyForUpdateSAV-****, (5) ReadyForUpdateSAV-Info, (6) SAV-****, (7) SAV-Info, (8) StateChange, (9) SuspendedSAV-****, (10) SuspendedSAV-Info, (11) UpdateComplete, (12) UpdateMutex, (13) UpdateRequest, or (14) SophosALMonSessionInstance, as demonstrated by triggering a ReadyForUpdateSAV event and modifying the UpdateComplete, UpdateMutex, and UpdateRequest objects.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sophos Scanning Engine | <=3.48 | |
| Sophos Sophos Anti-virus | =10.0.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://osvdb.org/102762
- http://packetstormsecurity.com/files/125024/Sophos-Anti-Virus-Denial-Of-Service.html
- http://seclists.org/fulldisclosure/2014/Feb/1
- http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1213/
- http://www.securityfocus.com/archive/1/530915/100/0/threaded
- http://www.securityfocus.com/bid/65286
- http://www.securitytracker.com/id/1029713
- http://www.sophos.com/en-us/support/knowledgebase/2300/7200/1031/120401.aspx
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/type
- agent/event
- agent/description
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/sophos
- canonical/sophos scanning engine
- version/sophos scanning engine/3.48
- canonical/sophos sophos anti-virus
- version/sophos sophos anti-virus/10.0.11