Core Security Technologies has reported a vulnerability in Sophos Anti-Virus, which can be exploited by malicious, local users to cause a DoS (Denial of Service).

The vulnerability is caused due to an input validation error when handling arguments passed to the hooked SSDT function "NtCreateKey()". This can be exploited to cause a DoS by calling the affected function with specially crafted arguments.

Successful exploitation requires that the "Block suspicious behavior" detection is enabled.

The vulnerability affects version 7.x on Windows.

Solution
The vendor is reportedly working on a fix.

Provided and/or discovered by
Damian Saura, Anibal Sacco, Dario Menichelli, Norberto Kueffner, and Andres Blanco y Rodrigo Carvalho of Core Security Technologies

Original Advisory
CORE-2008-0320:
http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=2249

Sophos:
http://www.sophos.com/support/knowledgebase/article/37810.html

Deep Links
Links available in Customer Area