BID:26121

Macrovision SafeDisc SecDRV.SYS Method_Neither Local Privilege Escalation Vulnerability

Info

Macrovision SafeDisc SecDRV.SYS Method_Neither Local Privilege Escalation Vulnerability

Bugtraq ID:	26121
Class:	Design Error
CVE:	CVE-2007-5587
Remote:	No
Local:	Yes
Published:	Oct 18 2007 12:00AM
Updated:	Dec 19 2007 02:11PM
Credit:	Elia Florio of Symantec found this issue being exploited in the wild.
Vulnerable:	Microsoft Windows XP Tablet PC Edition SP2 Microsoft Windows XP Professional x64 Edition Microsoft Windows XP Professional SP2 Microsoft Windows XP Media Center Edition SP2 Microsoft Windows XP Home SP2 Microsoft Windows Server 2003 x64 SP2 Microsoft Windows Server 2003 Web Edition SP2 Microsoft Windows Server 2003 Web Edition SP1 Microsoft Windows Server 2003 Standard x64 Edition Microsoft Windows Server 2003 Standard Edition SP2 Microsoft Windows Server 2003 Standard Edition SP1 Microsoft Windows Server 2003 Enterprise x64 Edition Microsoft Windows Server 2003 Enterprise Edition SP1 Microsoft Windows Server 2003 Datacenter x64 Edition Microsoft Windows Server 2003 Datacenter Edition SP1 Microsoft Windows Server 2003 SP2 Microsoft Windows Server 2003 SP1 Macrovision Safedisc 0 HP Storage Management Appliance III HP Storage Management Appliance II HP Storage Management Appliance I HP Storage Management Appliance 2.1 + HP Storage Management Appliance III + HP Storage Management Appliance II + HP Storage Management Appliance I Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server MM 1.1 Avaya Messaging Application Server 0

Not Vulnerable:

Discussion

Macrovision SafeDisc SecDRV.SYS Method_Neither Local Privilege Escalation Vulnerability

Macrovision SafeDisc is prone to a local privilege-escalation vulnerability because it fails to adequately sanitize user-supplied input.

Exploiting this vulnerability allows local attackers to execute arbitrary malicious code with SYSTEM-level privileges, facilitating the complete compromise of affected computers.

UPDATE: This issue affects only Microsoft Windows XP and 2003 platforms. Microsoft Vista is not affected.

Exploit / POC

Macrovision SafeDisc SecDRV.SYS Method_Neither Local Privilege Escalation Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product:

http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=1991

NOTE: This issue is being exploited in the wild.

The following exploit is available:

/data/vulnerabilities/exploits/26121-secdrv-plugin_exploit_32bit.zip

Solution / Fix

Macrovision SafeDisc SecDRV.SYS Method_Neither Local Privilege Escalation Vulnerability

Solution:
The vendor released a patch to address this issue. Please see the references for more information.

Microsoft released a security bulletin to provide updates for supported versions of Microsoft Windows XP and Server 2003. This bulletin provides the same fixes offered by Macrovision. Please see the references for more information.

Microsoft Windows Server 2003 Datacenter Edition SP1