Resolved LPE in HitmanPro.Alert (CVE-2021-25270)

返回安全公告概览
High
CVE(s)
CVE-2021-25270
Updated:
产品
HitmanPro.Alert
发布 ID sophos-sa-20211007-hmpa-lpe
文章版本 2
First Published
解决方法 No

Overview

A local privilege escalation vulnerability in HitmanPro.Alert was discovered and responsibly disclosed to Sophos. It was reported via the Sophos bug bounty program by an external security researcher. The vulnerability has been fixed. There is no action required for customers, as updates are installed automatically by default.

Sophos would like to thank Michael Bourque (@downwithupsec) for responsibly disclosing the issues to Sophos.

The remediation prevented local users from executing arbitrary code with administrator privileges. There was no evidence that the vulnerability was exploited and to our knowledge no customers are impacted.

Applies to the following Sophos product(s) and version(s)

  • Sophos HitmanPro.Alert prior version Build 901

The Sophos Intercept X family is not impacted by this advisory.

Remediation

  • Fix included in HitmanPro.Alert Build 901 and Build 903, released June 23, 2021

Related Information