CVE-2014-1213

N/A Unknown
Published: February 10, 2014 Modified: April 29, 2026
View on NVD

Description

Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11, and 10.3.x before 10.3.1 does not set an ACL for certain global and session objects, which allows local users to bypass anti-virus protection, cause a denial of service (resource consumption, CPU consumption, and eventual crash) or spoof "ready for update" messages by performing certain operations on mutexes or events including (1) DataUpdateRequest, (2) MmfMutexSAV-****, (3) MmfMutexSAV-Info, (4) ReadyForUpdateSAV-****, (5) ReadyForUpdateSAV-Info, (6) SAV-****, (7) SAV-Info, (8) StateChange, (9) SuspendedSAV-****, (10) SuspendedSAV-Info, (11) UpdateComplete, (12) UpdateMutex, (13) UpdateRequest, or (14) SophosALMonSessionInstance, as demonstrated by triggering a ReadyForUpdateSAV event and modifying the UpdateComplete, UpdateMutex, and UpdateRequest objects.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://osvdb.org/102762
Source: cve@mitre.org
http://packetstormsecurity.com/files/125024/Sophos-Anti-Virus-Denial-Of-Service.html
Source: cve@mitre.org
http://seclists.org/fulldisclosure/2014/Feb/1
Source: cve@mitre.org
http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1213/
Source: cve@mitre.org
http://www.securityfocus.com/archive/1/530915/100/0/threaded
Source: cve@mitre.org
http://www.securityfocus.com/bid/65286
Source: cve@mitre.org
http://www.securitytracker.com/id/1029713
Source: cve@mitre.org
http://www.sophos.com/en-us/support/knowledgebase/2300/7200/1031/120401.aspx
Source: cve@mitre.org
http://osvdb.org/102762
Source: af854a3a-2127-422b-91ae-364da2661108
http://packetstormsecurity.com/files/125024/Sophos-Anti-Virus-Denial-Of-Service.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://seclists.org/fulldisclosure/2014/Feb/1
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1213/
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/archive/1/530915/100/0/threaded
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/bid/65286
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securitytracker.com/id/1029713
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.sophos.com/en-us/support/knowledgebase/2300/7200/1031/120401.aspx
Source: af854a3a-2127-422b-91ae-364da2661108

16 reference(s) from NVD

Quick Stats

CVSS v3 Score
N/A / 10.0
EPSS (Exploit Probability)
0.1%
24th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-264

Affected Vendors

sophos

Related CVEs

CVE-2026-8669 N/A
CVE-2026-46483 3.6
CVE-2026-45736 4.4
CVE-2026-39054 N/A
CVE-2026-39053 N/A