Microsoft warns of Macrovision DRM flaw

Share this article:
Updated Wednesday, Nov. 7 at 11:26 a.m. EST.

Microsoft warned users on Monday of attacks targeting a flaw in Macrovision's digital rights management software.

The Redmond, Wash.-based corporation released an advisory on Monday regarding the vulnerability, warning of limited attacks exploiting the flaw, which exists in Macrovision's secdrv.sys driver on supported editions of Windows Server 2003 and Windows XP operating systems. The flaw does not affect Windows Vista.

The vulnerability is caused by an input validation error when handling arguments, according to an advisory from Secunia.

An attacker must have local system access to exploit the flaw with a privilege-escalation attack, according to Microsoft.

Macrovision also advised end-users to update their PCs to patch the flaw, which was exposed as a zero day.

The Santa Clara, Calif.-based developer said it investigated the flaw and found attacks to be limited. Microsoft is also developing an update to fix the issue, Macrovision said in a statement.

Symantec Security Response researcher Elia Florio said today on a company blog that the flaw poses a much greater risk for corporate networks than for home users.

“It is a local exploit only, so the attacker has to be logged on to the computer with an account. This fact mitigates risks for home users who often work with one account on their computers. The situation is much more complicated for corporate networks, where multiple users with different privileges can log on to different computers,” said Florio. “However, all users should keep in mind that in a multilayered defense perspective it is possible that malware dropped on the system via some other exploit could potentially take advantage of the [secdrv.sys] bug to take further control of the computer and bypass other layers of protection.”

Florio found an exploit for the flaw on Oct. 16.

US-CERT today advised users to review Microsoft's advisory and apply Macrovision's patch.

SANS Internet Storm Center handler Maarten Van Horenbeeck said today on the organization's diary that the flaw could be exploited through other applications.

“This is a local attack that allows privilege escalation to Ring 0. However, this means it can be abused by those who are able to introduce and execute code on the system,” said Van Horenbeeck. “Depending on the situation, this could go beyond shared environments as it could be delivered to a system using a variety of other attack vectors (browser exploits, emails, file format exploits).”

Share this article:

Sign up to our newsletters

More in News

Pentagon to triple its security workforce by 2016

Pentagon to triple its security workforce by 2016

Defense Secretary Chuck Hagel recently announced the recruitment efforts during a speech in Fort Meade, Md.

Tech manufacturer's online payment system breached

LaCie confirmed an unauthorized party used malware to access its online payment system for almost a year and could have stolen customer information.

The Heartbleed bug works, and could be a scapegoat for older breaches

The Heartbleed bug works, and could be a ...

Researchers proved the Heartbleed bug was real in a challenge issued by CloudFlare to prove private keys can be stolen, right around the time companies are claiming they were breached ...