CVE-2018-6318: High severity SOPHOS Sophos Tester vulnerability
In Sophos Tester Tool 3.2.0.7 Beta, the driver loads (in the context of the application used to test an exploit or ransomware) the DLL using a payload that runs from NTDLL.DLL (so, it's run in userland), but the driver doesn't perform any validation of this DLL (not its signature, not its hash, etc.). A person can change this DLL in a local way, or with a remote connection, to a malicious DLL with the same name -- and when the product is used, this malicious DLL will be loaded, aka a DLL Hijacking attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-6318?
CVE-2018-6318 has a medium severity rating due to its potential to allow unauthorized execution of code.
How do I fix CVE-2018-6318?
To mitigate CVE-2018-6318, update to a patched version of Sophos Tester Tool that addresses this vulnerability.
What systems are affected by CVE-2018-6318?
CVE-2018-6318 specifically affects Sophos Tester Tool version 3.2.0.7 Beta.
What types of attacks can CVE-2018-6318 facilitate?
CVE-2018-6318 can facilitate code execution attacks by exploiting the lack of DLL validation.
Is there a known exploit for CVE-2018-6318?
Yes, there are proofs of concept that show how CVE-2018-6318 can be exploited to execute arbitrary code.