|
Another Copy Protection System Lets the Hackers In |
|
|
|
|
Written by Editor
|
|
Tuesday, 06 November 2007 |
|
Just like the little Sony DRM rootkit problem from 2005 that could be used for no good, it seems a component of Macrovision copy protection included within Windows XP and Windows 2003 can be used to elevate privileges and compromise systems.
The flaw, which occurs in the ‘secdrv.sys’ driver, could allow malicious code to elevate its privileges on the targeted machine. The flaw it seems has been used in a limited number of attacks and Microsoft are monitoring the situation. All is not lost however, Macrovision have released a patch which you can find here and Microsoft are planning to push out a fix as part of Windows Update.
The flaw allows local users to overwrite arbitrary memory locations and gain privileges via a crafted argument to a METHOD_NEITHER IOCTL. You can find out more about the issue from CVE-2007-5587. |
Welcome to Virus.Org ! 
