CVE Vulnerability

CVE-2018-6318

In Sophos Tester Tool 3.2.0.7 Beta, the driver loads (in the context of the application used to test an exploit or ransomware) the DLL using a payload that runs from NTDLL.DLL (so, it's run in userland), but the driver doesn't perform any validation of this DLL (not its signature, not its hash, etc.). A person can change this DLL in a local way, or with a remote connection, to a malicious DLL with the same name -- and when the product is used, this malicious DLL will be loaded, aka a DLL Hijacking attack.

9.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

7.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://29wspy.ru/exploits/CVE-2018-6318.pdf Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:sophos:sophos_tester:3.2.0.7:beta:*:*:*:*:*:*
Information

Published : 2018-02-02 09:29

Updated : 2018-02-15 03:41

NVD link : CVE-2018-6318

Mitre link : CVE-2018-6318

Products Affected
No products.
CWE
CWE-426

Untrusted Search Path