Updated Wednesday, Nov. 7 at 11:26 a.m. EST. Microsoft
warned users on Monday of attacks targeting a flaw in Macrovision
's digital rights management
The Redmond, Wash.-based corporation released an advisory
on Monday regarding the vulnerability, warning of limited attacks exploiting the flaw, which exists in Macrovision's secdrv.sys driver on supported editions of Windows Server 2003
and Windows XP
operating systems. The flaw does not affect Windows Vista
The vulnerability is caused by an input validation error
when handling arguments, according to an advisory
An attacker must have local system access to exploit the flaw with a privilege-escalation attack, according to Microsoft.
Macrovision also advised end-users to update their PCs to patch the flaw, which was exposed as a zero day
The Santa Clara, Calif.-based developer said it investigated the flaw and found attacks to be limited. Microsoft is also developing an update to fix the issue, Macrovision said in a statement. Symantec Security Response
researcher Elia Florio said today on a company blog
that the flaw poses a much greater risk for corporate networks than for home users.
“It is a local exploit only, so the attacker has to be logged on to the computer with an account. This fact mitigates risks for home users who often work with one account on their computers. The situation is much more complicated for corporate networks, where multiple users with different privileges can log on to different computers,” said Florio. “However, all users should keep in mind that in a multilayered defense perspective it is possible that malware dropped on the system via some other exploit could potentially take advantage of the [secdrv.sys] bug to take further control of the computer and bypass other layers of protection.”
Florio found an exploit for the flaw on Oct. 16. US-CERT
users to review Microsoft's advisory and apply Macrovision's patch. SANS Internet Storm Center
handler Maarten Van Horenbeeck said today on the organization's diary that the flaw could be exploited through other applications.
“This is a local attack that allows privilege escalation to Ring 0. However, this means it can be abused by those who are able to introduce and execute code on the system,” said Van Horenbeeck. “Depending on the situation, this could go beyond shared environments as it could be delivered to a system using a variety of other attack vectors (browser exploits, emails, file format exploits).”