CVE-2014-1213

CVE-2014-1213 describes a local privilege escalation and denial-of-service vulnerability in the Sophos Anti-Virus engine (SAVi) versions prior to 3.50.1, affecting Sophos Anti-Virus products. The vulnerability stems from the engine's failure to set proper Access Control Lists (ACLs) for various global and session objects, allowing local users to manipulate these objects. This manipulation can bypass anti-virus protection, cause a denial of service through resource exhaustion and crashes, or spoof "ready for update" messages. The vulnerability has a CVSS score of 5.6 (Medium), indicating a local attack vector (AV:L) with low attack complexity (AC:L) and no authentication required (Au:N). The potential impact includes partial integrity compromise (I:P) and complete availability compromise (A:C). There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion is minimal, with only one mention found, suggesting low public attention.