Microsoft warns of Macrovision DRM flaw

Share this article:
Updated Wednesday, Nov. 7 at 11:26 a.m. EST.

Microsoft warned users on Monday of attacks targeting a flaw in Macrovision's digital rights management software.

The Redmond, Wash.-based corporation released an advisory on Monday regarding the vulnerability, warning of limited attacks exploiting the flaw, which exists in Macrovision's secdrv.sys driver on supported editions of Windows Server 2003 and Windows XP operating systems. The flaw does not affect Windows Vista.

The vulnerability is caused by an input validation error when handling arguments, according to an advisory from Secunia.

An attacker must have local system access to exploit the flaw with a privilege-escalation attack, according to Microsoft.

Macrovision also advised end-users to update their PCs to patch the flaw, which was exposed as a zero day.

The Santa Clara, Calif.-based developer said it investigated the flaw and found attacks to be limited. Microsoft is also developing an update to fix the issue, Macrovision said in a statement.

Symantec Security Response researcher Elia Florio said today on a company blog that the flaw poses a much greater risk for corporate networks than for home users.

“It is a local exploit only, so the attacker has to be logged on to the computer with an account. This fact mitigates risks for home users who often work with one account on their computers. The situation is much more complicated for corporate networks, where multiple users with different privileges can log on to different computers,” said Florio. “However, all users should keep in mind that in a multilayered defense perspective it is possible that malware dropped on the system via some other exploit could potentially take advantage of the [secdrv.sys] bug to take further control of the computer and bypass other layers of protection.”

Florio found an exploit for the flaw on Oct. 16.

US-CERT today advised users to review Microsoft's advisory and apply Macrovision's patch.

SANS Internet Storm Center handler Maarten Van Horenbeeck said today on the organization's diary that the flaw could be exploited through other applications.

“This is a local attack that allows privilege escalation to Ring 0. However, this means it can be abused by those who are able to introduce and execute code on the system,” said Van Horenbeeck. “Depending on the situation, this could go beyond shared environments as it could be delivered to a system using a variety of other attack vectors (browser exploits, emails, file format exploits).”

Share this article:

Sign up to our newsletters

More in News

Apple hit with privacy class-action over iPhone location service

Apple hit with privacy class-action over iPhone location ...

A woman claims she did not realize the company was using location services to track her and accuses the company of giving the data to third parties.

Attackers compromise Gizmodo Brazil

Trend Micro is investigating whether a vulnerability was used to compromise Gizmodo Brazil and a logistics firm hosted by the same ISP.

Paddy Power breach impacting 650K customers dates back to 2010

Nearly 650,000 Paddy Power customers who made an account prior to 2010 had data compromised in a breach.