Description
Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professional x64 and x64 SP2, Server 2003 SP1 and SP2, and Server 2003 x64 and x64 SP2 allows local users to overwrite arbitrary memory locations and gain privileges via a crafted argument to a METHOD_NEITHER IOCTL, as originally discovered in the wild.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Macrovision SafeDisc - 'SecDRV.SYS' Method_Neither Privilege Escalation EDB-30680 · local · Oct 18, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://www.reversemode.com/index.php?option=com_mamblog&Itemid=15&task=show&action=view&id=43&Itemid=15
- http://blog.48bits.com/?p=172
- 27285 third-party-advisory
- 944653 vendor-advisory
- oval:org.mitre.oval:def:4584 vdb-entry signature
- ADV-2007-3537 vdb-entry
- SSRT071506 vendor-advisory
- http://www.symantec.com/enterprise/security_response/weblog/2007/10/privilege_escalation_exploit_i.html
- 41429 vdb-entry
- TA07-345A third-party-advisory
- 20071018 [CORRECTED] Microsoft Windows XP SP2/2003 - Macrovision SecDrv.sys privilege escalation (0day) mailing-list
- windows-secdrv-bo(37284) vdb-entry
- 20071017 Microsoft Windows XP/2003 Macrovision SecDrv.sys privilege escalation (0day) mailing-list
- 3266 third-party-advisory
- 1018833 vdb-entry
- 26121 vdb-entry
- MS07-067 vendor-advisory