CVE-2018-6318: sophos sophos_tester Untrusted Search Path

Vulnerability summary

CVE-2018-6318 is a high (CVSS 9.3) Untrusted Search Path vulnerability in sophos sophos_tester. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63.1% of scored vulnerabilities.

Timeline

1. 02-02-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

In Sophos Tester Tool 3.2.0.7 Beta, the driver loads (in the context of the application used to test an exploit or ransomware) the DLL using a payload that runs from NTDLL.DLL (so, it's run in userland), but the driver doesn't perform any validation of this DLL (not its signature, not its hash, etc.). A person can change this DLL in a local way, or with a remote connection, to a malicious DLL with the same name -- and when the product is used, this malicious DLL will be loaded, aka a DLL Hijacking attack.

• CWE-426Untrusted Search PathThe product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.