Sophos HitmanPro.Alert Multiple Security Vulnerabilities

Sophos HitmanPro.Alert is prone to the following security vulnerabilities:

1. An information-disclosure vulnerability
2. A local privilege-escalation vulnerability

An attacker can leverage these issues to obtain sensitive information and gain elevated privileges. Failed exploit attempts may result in a denial of service condition.
Sophos HitmanPro.Alert is 3.7.6.744 is vulnerable; other versions may also be affected.

Information

Bugtraq ID: 105743
Class: Input Validation Error
CVE: CVE-2018-3970
CVE-2018-3971

Remote: No
Local: Yes
Published: Oct 25 2018 12:00AM
Updated: Oct 25 2018 12:00AM
Credit: Marcin 'Icewall' Noga of Cisco Talos.
Vulnerable: Sophos HitmanPro.Alert 3.7.6.744

Not Vulnerable:

Exploit

Exploit codes are available; please see the references for more information.

References:

• HitmanPro.Alert Homepage (Sophos)
  
• Sophos HitmanPro.Alert hmpalert 0x222000 kernel memory disclosure vulnerability (Cisco Talos)
  
• Sophos HitmanPro.Alert hmpalert 0x2222CC privilege escalation vulnerability (Cisco Talos)
  
• Vulnerability Spotlight: TALOS-2018-0635/0636 - Sophos HitmanPro.Alert memory di (Talos)
  

Source: www.securityfocus.com