← Vulnerability feed

Vulnerability record · CVE-2014-1213 · published 10 February 2014

CVE-2014-1213: Sophos scanning engine permissions and access controls vulnerability

Sophos · Scanning Engine

Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11, and 10.3.x before 10.3.1 does not set an ACL for certain global and session objects, which allows local users to bypass anti-virus protection, cause a denial of service (resource consumption, CPU consumption, and eventual crash) or spoof "ready for update" messages by performing certain operations on mutexes or events including (1) DataUpdateRequest, (2) MmfMutexSAV-****, (3) MmfMutexSAV-Info, (4) ReadyForUpdateSAV-****, (5) ReadyForUpdateSAV-Info, (6) SAV-****, (7) SAV-Info, (8) StateChange, (9) SuspendedSAV-****, (10) SuspendedSAV-Info, (11) UpdateComplete, (12) UpdateMutex, (13) UpdateRequest, or (14) SophosALMonSessionInstance, as demonstrated by triggering a ReadyForUpdateSAV event and modifying the UpdateComplete, UpdateMutex, and UpdateRequest objects.

5.6 CVSS 2.0 Medium EPSS 0.97% · top 39.5% CWE-264 · Permissions and access controls
5.6CVSS 2.0 base score
0.97%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
16References
17 Jun 2026Last modified by NVD

Description

Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11, and 10.3.x before 10.3.1 does not set an ACL for certain global and session objects, which allows local users to bypass anti-virus protection, cause a denial of service (resource consumption, CPU consumption, and eventual crash) or spoof "ready for update" messages by performing certain operations on mutexes or events including (1) DataUpdateRequest, (2) MmfMutexSAV-****, (3) MmfMutexSAV-Info, (4) ReadyForUpdateSAV-****, (5) ReadyForUpdateSAV-Info, (6) SAV-****, (7) SAV-Info, (8) StateChange, (9) SuspendedSAV-****, (10) SuspendedSAV-Info, (11) UpdateComplete, (12) UpdateMutex, (13) UpdateRequest, or (14) SophosALMonSessionInstance, as demonstrated by triggering a ReadyForUpdateSAV event and modifying the UpdateComplete, UpdateMutex, and UpdateRequest objects.

AV:L/AC:L/Au:N/C:N/I:P/A:C

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://osvdb.org/102762
http://packetstormsecurity.com/files/125024/Sophos-Anti-Virus-Denial-Of-Service.html
http://seclists.org/fulldisclosure/2014/Feb/1
http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1213/
http://www.securityfocus.com/archive/1/530915/100/0/threaded
http://www.securityfocus.com/bid/65286
http://www.securitytracker.com/id/1029713
http://www.sophos.com/en-us/support/knowledgebase/2300/7200/1031/120401.aspx
http://osvdb.org/102762
http://packetstormsecurity.com/files/125024/Sophos-Anti-Virus-Denial-Of-Service.html
http://seclists.org/fulldisclosure/2014/Feb/1
http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1213/
http://www.securityfocus.com/archive/1/530915/100/0/threaded
http://www.securityfocus.com/bid/65286
http://www.securitytracker.com/id/1029713
http://www.sophos.com/en-us/support/knowledgebase/2300/7200/1031/120401.aspx

Track CVE-2014-1213 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2006-6335Sophos anti-virus vulnerabilityMultiple buffer overflows in Sophos Anti-Virus scanning engine before 2.40 allow remote attackers to execute arbitrary code via (1) a SIT archive wit…EPSS 13%7.8CVE-2007-4577Sophos anti-virus vulnerabilitySophos Anti-Virus for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed BZip file that re…EPSS 5.5%7.5CVE-2006-0994Sophos anti-virus vulnerabilityMultiple Sophos Anti-Virus products, including Anti-Virus for Windows 5.x before 5.2.1 and 4.x before 4.05, when cabinet file inspection is enabled, …EPSS 22%7.5CVE-2005-2768Sophos anti-virus vulnerabilityHeap-based buffer overflow in the Sophos Antivirus Library, as used by Sophos Antivirus, PureMessage, MailMonitor, and other products, allows remote …EPSS 13%7.5CVE-2004-0937Archive zip vulnerabilitySophos Anti-Virus before 3.87.0, and Sophos Anti-Virus for Windows 95, 98, and Me before 3.88.0, allows remote attackers to bypass antivirus protecti…EPSS 15%7.5CVE-2004-0932McAfee Anti-Virus Engine DATS driver bypass via malformed compressed fileThe McAfee Anti-Virus Engine DATS drivers before 4398 (Oct 13 2004) and DATS Driver before 4397 (Oct 6 2004) fail to properly handle compressed files…EPSS 63%analysed7.5CVE-2004-0933Archive zip vulnerabilityComputer Associates (CA) InoculateIT 6.0, eTrust Antivirus r6.0 through r7.1, eTrust Antivirus for the Gateway r7.0 and r7.1, eTrust Secure Content M…EPSS 21%7.5CVE-2004-0934Archive zip vulnerabilityKaspersky 3.x to 4.x allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, whi…EPSS 15%

Source: NIST National Vulnerability Database (record CVE-2014-1213), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.