CVE-2018-6855 : What You Need to Know

Sophos SafeGuard Enterprise, SafeGuard Easy, and SafeGuard LAN Crypt versions prior to 8.00.5, 7.00.3, and 3.95.2 respectively, are vulnerable to a local privilege escalation vulnerability through IOCTL 0x80202014. This vulnerability allows an attacker to manipulate memory addresses and gain elevated privileges.

Understanding CVE-2018-6855

This CVE details a security flaw in Sophos SafeGuard products that can be exploited for local privilege escalation.

What is CVE-2018-6855?

The vulnerability in Sophos SafeGuard products allows an attacker to escalate privileges locally by manipulating memory addresses.

The Impact of CVE-2018-6855

The exploitation of this vulnerability can lead to an attacker gaining elevated privileges, potentially allowing them to execute code in the security context of higher privileged processes.

Technical Details of CVE-2018-6855

This section provides technical insights into the vulnerability.

Vulnerability Description

By crafting a specific input buffer, an attacker can manipulate the execution path to assign a user-controlled memory address the value 0xFFFFFFF, granting the SE_DEBUG_NAME privilege to the exploited process.

Affected Systems and Versions

Sophos SafeGuard Enterprise versions prior to 8.00.5
SafeGuard Easy versions prior to 7.00.3
SafeGuard LAN Crypt versions prior to 3.95.2

Exploitation Mechanism

The vulnerability can be exploited through IOCTL 0x80202014, enabling the attacker to modify the Token object associated with the process being exploited, granting it elevated privileges.

Mitigation and Prevention

Protecting systems from CVE-2018-6855 requires immediate actions and long-term security practices.

Immediate Steps to Take

Apply security patches provided by Sophos for the affected products.
Monitor for any unusual activities on the network that could indicate exploitation of the vulnerability.

Long-Term Security Practices

Regularly update and patch all software and systems to prevent known vulnerabilities.
Implement the principle of least privilege to restrict access rights for users and processes.

Patching and Updates

Sophos has released patches to address the vulnerability. Ensure all affected systems are updated with the latest security fixes.