By Numerous vulnerabilities identified in Sophos SafeGuard file encryption and full-disk products. The flaws consent a hacker to increase exemptions on a cooperated device and perform random code with SYSTEM approvals. Researchers at Nettitude have revealed a total amount of seven local opportunity increase flaws.
The security flaws can be the action via numerous IOCTL calls consuming particularly created input buffers that permit hackers to regulate the implementation path. Nettitude has issued technical information for each of the vulnerabilities, accompanied by a video presenting how a hacker got the access to target device can intensify actions to SYSTEM.
Sophos published the vulnerabilities affecting of numerous versions according to an advisory of SafeGuard Easy, SafeGuard Enterprise Client, and SafeGuard LAN Crypt for Windows. The flaws have been allocated the CVE classifier CVE-2018-6851 through CVE-2018-6857.
“Sophos is not aware of any attacks leveraging those vulnerabilities or exploits for them being available,” the security firm wrote in its advisory. “Exploitation of those vulnerabilities requires running malicious code on the target machine and can result in privilege escalation. This vulnerability is not remotely exploitable (i.e. over the network).”
The flaws were conveyed to Sophos this year in January and fixes were formed a couple of months back in April. Sophos has recommended the users to install the obtainable fixes.
