CVE:CVE-2018-6857
CNNVD:CNNVD-201807-481
Sophos SafeGuard Enterprise、SafeGuard Easy和SafeGuard LAN Crypt都是英国Sophos公司的产品。Sophos SafeGuard Enterprise是一套数据安全加密和数据防泄漏解决方案；SafeGuard Easy是一款提供了硬盘加密功能的网络安全组件；SafeGuard LAN Crypt是一套用于数据加密并提供授权管理功能的解决方案。
Sophos SafeGuard Enterprise 8.00.5之前版本、SafeGuard Easy 7.00.3之前版本、SafeGuard LAN Crypt 3.95.2之前版本中存在提权漏洞。本地攻击者可借助IOCTL 0x802022E0利用该漏洞提升权限并在SYSTEM用户账户的安全上下文中执行代码。
solution:Upgrade sophos safeguard_easy_device_encryption_client to a higher version than 6.00,6.10,7.00,and avoid the version 6.00,6.10,7.00; Upgrade sophos safeguard_enterprise_client to a higher version than 5.60.3:vs-nfd,6.00,6.00.1,6.10,7.00,8.00,and avoid the version 5.60.3:vs-nfd,6.00,6.00.1,6.10,7.00,8.00; Upgrade sophos safeguard_lan_crypt_client to a higher version than 3.90.1:ts,3.90.2,3.95.1,3.95.1:ts,and avoid the version 3.90.1:ts,3.90.2,3.95.1,3.95.1:ts