Cisco Talos shows how an attacker could leverage TALOS-2018-0636 to build a stable exploit to gain SYSTEM rights on the local machine. The vulnerability is triggered by the IOCTL code ‘0x2222CC’ in Sophos HitmanPro.Alert’s IO control handler. Sophos patched two vulnerabilities in version 3.7.9.759.759 last week. We show how the exploitation process can be done using the OSR Device Tree tool to analyse the vulnerable code.”]
Source: https://blog.talosintelligence.com/2018/11/TALOS-2018-0636.html