Vulnerabilities for Scanning engine (...) - CXSECURITY.COM

Vulnerabilities for 'Scanning engine'

2014-02-10

CVE-2014-1213

CWE-264

Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11, and 10.3.x before 10.3.1 does not set an ACL for certain global and session objects, which allows local users to bypass anti-virus protection, cause a denial of service (resource consumption, CPU consumption, and eventual crash) or spoof "ready for update" messages by performing certain operations on mutexes or events including (1) DataUpdateRequest, (2) MmfMutexSAV-, (3) MmfMutexSAV-Info, (4) ReadyForUpdateSAV-, (5) ReadyForUpdateSAV-Info, (6) SAV-, (7) SAV-Info, (8) StateChange, (9) SuspendedSAV-, (10) SuspendedSAV-Info, (11) UpdateComplete, (12) UpdateMutex, (13) UpdateRequest, or (14) SophosALMonSessionInstance, as demonstrated by triggering a ReadyForUpdateSAV event and modifying the UpdateComplete, UpdateMutex, and UpdateRequest objects.

2007-09-10

CVE-2007-4787

CWE-20

The virus detection engine in Sophos Anti-Virus before 2.49.0 does not properly process malformed (1) CAB, (2) LZH, and (3) RAR files with modified headers, which might allow remote attackers to bypass malware detection.

2007-08-28

CVE-2007-4578

CWE-189

Sophos Anti-Virus for Windows and for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UPX packed file, resulting from an "integer cast around". NOTE: as of 20070828, the vendor says this is a DoS and the researcher says this allows code execution, but the researcher is reliable.

CVE-2007-4577

CWE-noinfo

Sophos Anti-Virus for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed BZip file that results in the creation of multiple Engine temporary files (aka a "BZip bomb").

>>> Vendor: Sophos 53 Products

Small business suite

Sophos anti-virus

Sophos puremessage anti-virus

Sophos small business suite

Sophos mailmonitor

Sophos mailmonitor for notes domino

Endpoint security

Scanning engine

Anti-virus7.6.3

Puremessage for microsoft exchange

Unified threat management software

Unified threat management

Disk encryption

Safeguard easy device encryption client

Safeguard enterprise device encryption

Sophos endpoint security and control

Safeguard enterprise

Free encryption

Safeguard privatecrypto

Web appliance firmware

Enterprise console

Cyberoam cr100ing utm firmware

Cyberoam cr35ing utm firmware

Unified threat management up2date

Mobile control eas proxy

Cyberoam cr25ing utm firmware

Cyberoam firmware

Threat detection engine

Astaro security gateway firmware

Endpoint protection

Invincea dell protected workspace

Safeguard enterprise client

Safeguard lan crypt client

Hitmanpro.alert

Sophos secure email

Xg firewall firmware

Sophos secure workspace

Exploit prevention

Intercept x endpoint

Intercept x for server

Copyright 2024, cxsecurity.com