CVE-2017-6007 : Vulnerability Insights and Analysis

A local user can crash the operating system by making a malformed IOCTL call due to a kernel pool overflow issue present in the driver hitmanpro37.sys of Sophos SurfRight HitmanPro versions before 3.7.20 Build 286. This vulnerability is also found in the HitmanPro.Alert solution and Sophos Clean.

Understanding CVE-2017-6007

This CVE involves a kernel pool overflow vulnerability in Sophos SurfRight HitmanPro versions before 3.7.20 Build 286, HitmanPro.Alert, and Sophos Clean.

What is CVE-2017-6007?

A local user can trigger a kernel pool overflow by making a malformed IOCTL call, leading to a system crash.

The Impact of CVE-2017-6007

The vulnerability allows local users to crash the operating system, potentially causing denial of service.

Technical Details of CVE-2017-6007

This section provides detailed technical information about the CVE.

Vulnerability Description

The driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286, HitmanPro.Alert, and Sophos Clean is susceptible to a kernel pool overflow, enabling local users to crash the OS via a malformed IOCTL call.

Affected Systems and Versions

Sophos SurfRight HitmanPro versions before 3.7.20 Build 286
HitmanPro.Alert
Sophos Clean

Exploitation Mechanism

The vulnerability can be exploited by a local user through a specially crafted IOCTL call, causing a kernel pool overflow and resulting in a system crash.

Mitigation and Prevention

Protecting systems from CVE-2017-6007 requires immediate actions and long-term security practices.

Immediate Steps to Take

Apply security patches provided by Sophos for the affected products.
Monitor for any unusual system behavior that could indicate exploitation of the vulnerability.

Long-Term Security Practices

Regularly update and patch all software and drivers to prevent known vulnerabilities.
Implement the principle of least privilege to restrict user access and minimize the impact of potential attacks.

Patching and Updates

Sophos has released patches addressing the kernel pool overflow vulnerability in the affected products. Ensure timely installation of these patches to mitigate the risk of exploitation.