Sophos Anti-Virus SSDT Hooks Local Denial of Service Vulnerability

Bugtraq ID:	28743
Class:	Boundary Condition Error
CVE:	CVE-2008-1737
Remote:	No
Local:	Yes
Published:	Apr 28 2008 12:00AM
Updated:	Apr 29 2008 07:26PM
Credit:	Damian Saura, Anibal Sacco, Daro Menichelli, Norberto Kueffner, Andrs Blanco y Rodrigo Carvalho from Core Security Technologies
Vulnerable:	Sophos Anti-Virus 7.05
Not Vulnerable:

Sophos Anti-Virus SSDT Hooks Local Denial of Service Vulnerability

Sophos Anti-Virus is prone to a local denial-of-service vulnerability because it fails to adequately bounds-check user-supplied data.

Exploiting this vulnerability allows local attackers to crash affected computers, denying service to legitimate users. Attackers might also be able to gain elevated privileges by executing arbitrary machine code in the context of the kernel, but this has not been confirmed.

Sophos Anti-Virus 7.0.5 is vulnerable; other versions may also be affected.

Sophos Anti-Virus SSDT Hooks Local Denial of Service Vulnerability

Attackers can use 'BSODhook' from Matousec to exploit this issue.

Sophos Anti-Virus SSDT Hooks Local Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sophos Anti-Virus SSDT Hooks Local Denial of Service Vulnerability

References:

• Sophos Anti-Virus Home Page (Sophos)
  
• Sophos Homepage (Sophos)
  
• Windows Personal Firewall Analysis (Matousec)
  
• Plague in (security) software drivers & BSDOhook utility (Matousec)
  
• Advisory: Sophos Anti-Virus for Windows 2000+, denial of service vulnerability (Sophos)
  
• CORE-2008-0320 Insufficient argument validation of hooked SSDT functions on mult (Core Security Technologies )