Microsoft warns of Macrovision DRM flaw

The Redmond, Wash.-based corporation released an advisory on Monday regarding the vulnerability, warning of limited attacks exploiting the flaw, which exists in Macrovision's secdrv.sys driver on supported editions of Windows Server 2003 and Windows XP operating systems. The flaw does not affect Windows Vista.

The vulnerability is caused by an input validation error when handling arguments, according to an advisory from Secunia.

An attacker must have local system access to exploit the flaw with a privilege-escalation attack, according to Microsoft.

Macrovision also advised end-users to update their PCs to patch the flaw, which was exposed as a zero day.

Symantec Security Response researcher Elia Florio said today on a company blog that the flaw poses a much greater risk for corporate networks than for home users.

“It is a local exploit only, so the attacker has to be logged on to the computer with an account. This fact mitigates risks for home users who often work with one account on their computers. The situation is much more complicated for corporate networks, where multiple users with different privileges can log on to different computers,” said Florio.

“However, all users should keep in mind that in a multilayered defense perspective it is possible that malware dropped on the system via some other exploit could potentially take advantage of the [secdrv.sys] bug to take further control of the computer and bypass other layers of protection.”

Florio found an exploit for the flaw on Oct. 16.

US-CERT today advised users to review Microsoft's advisory and apply Macrovision's patch.

SANS Internet Storm Center handler Maarten Van Horenbeeck said today on the organisation's diary that the flaw could be exploited through other applications.

“This is a local attack that allows privilege escalation to Ring 0. However, this means it can be abused by those who are able to introduce and execute code on the system,” said Van Horenbeeck.

“Depending on the situation, this could go beyond shared environments as it could be delivered to a system using a variety of other attack vectors (browser exploits, emails, file format exploits).”

See original article on SC Magazine US

Copyright © SC Magazine, US edition

drmflawmacrovisionmicrosoftmicrosoft securitysecurity