What is CVE-2017-6007?

CVE-2017-6007 is a medium-severity vulnerability in Sophos Hitmanpro, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 5.5/10. Published 2017-09-13.

How severe is CVE-2017-6007?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Buffer overflow in Sophos Hitmanpro

CVE-2017-6007

A kernel pool overflow in the driver hitmanpro37.sys in Sophos SurfRight HitmanPro before 3.7.20 Build 286 (included in the HitmanPro.Alert solution and Sophos Clean) allows local users to crash the OS via a malformed IOCTL call.

Vulnerability class: Buffer Overflow

EPSS: 0.004 (32.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Sophos Hitmanpro
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

cve@mitre.org (Technical Description, Exploit, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2017-6007?: CVE-2017-6007 is a medium-severity vulnerability in Sophos Hitmanpro, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 5.5/10. Published 2017-09-13.
How severe is CVE-2017-6007?: Medium severity. CVSS v3 base score is 5.5 out of 10.