[ WinXP ] Important update

[mechBgon]

Schadenfroh provided links to the finalized update patches by Microsoft :thumbsup: You can also get them by using the Microsoft Update site or by the Automatic Updates feature of Windows.

Originally posted by: Schadenfroh
Microsoft has issued their official patches:

XP 32
http://www.microsoft.com/downl...15e5317&DisplayLang=en

XP 64
http://www.microsoft.com/downl...7da69aa&DisplayLang=en

2k364
http://www.microsoft.com/downl...7daa0d7&DisplayLang=en

2k332
http://www.microsoft.com/downl...70b6b02&DisplayLang=en

Update for those interested: I see from this blog entry that Microsoft is testing the updated driver so they can eventually release it via the usual methods as a security patch.

As the vulnerable driver is included with Windows XP and Windows Server 2003 we wanted to make sure you knew that we are working with Macrovision to test the Macrovision update for deployment using Microsoft?s security update process. Once the update has gone through the Microsoft security update testing process, completed deployment testing and is ready for release, Microsoft will release it to customers as part of the Microsoft security update process.

So those wanting to fix this vulnerability right away should still get the patch from Macrovision. See below.


There is a notable security vulnerability in a Macrovision SafeDisc driver which shipped with WinXP and Windows Server 2003. It appears that it could be used by means of Trojans or exploits to attack your computer.

Macrovision's download page for the fix Download the Zip file, extract the contents, right-click the .INF file and choose Install.

Microsoft's security advisory on the topic They report the vulnerability is being exploited in the wild.


The bad guys exploit all sorts of stuff, including third-party apps like Acrobat Reader, QuickTime, Sun Java, WinZip, WinAmp, Yahoo Messenger, etc etc etc, so I'll mention the useful Secunia checkup tools that help you eliminate those weaknesses:

Secunia online checkup, which is Java-driven

Secunia's installable version (not Vista-compatible yet)

 

[SilentRunning]

From Security advisory:

Mitigating Factors

Microsoft Vista is not vulnerable to this issue.

An attacker must have logon permissions to the operating system to exploit this vulnerability.

&

What might an attacker use this driver to do?
An attacker with local access to a system could successfully exploit this vulnerability to gain elevation of privilege on an affected system.

Why does this make me think macrovision just wants to push an update onto users as a security risk.

 

[mechBgon]

An attacker must have logon permissions to the operating system to exploit this vulnerability.

And when you log onto your system to use it... yeah. An exploit or trojan could conceivably make you into the locally-logged-on attacker, basically.

 

[MustISO]

Why does this make me think macrovision just wants to push an update onto users as a security risk.

I was thinking the same thing. I do believe that there is a security risk with the driver but it would not suprise me if the "fix" comes with a rootkit or something worse.

 

[mechBgon]

Having installed the fix on a couple WinXP computers equipped with KAV7 and not gotten any rootkit warnings, I think maybe you have your tinfoil hat on a bit too tight

 

[SilentRunning]

Originally posted by: mechBgon
Having installed the fix on a couple WinXP computers equipped with KAV7 and not gotten any rootkit warnings, I think maybe you have your tinfoil hat on a bit too tight

I wasn't thinking rootkit so much as an update to macrovision to try to prevent current ways of circumventing it (more DRM.)

Calling it a security issue would push it on more systems than calling it an update to prevent piracy.

 

[mechBgon]

Originally posted by: SilentRunning

Originally posted by: mechBgon
Having installed the fix on a couple WinXP computers equipped with KAV7 and not gotten any rootkit warnings, I think maybe you have your tinfoil hat on a bit too tight

I wasn't thinking rootkit so much as an update to macrovision to try to prevent current ways of circumventing it (more DRM.)

Calling it a security issue would push it on more systems than calling it an update to prevent piracy.

As an alternative, I suppose you could rename the insecure driver file so it doesn't get used by anything, good or bad.

 

[mechBgon]

OP updated.

 

[SilentRunning]

I am preparing my tin foil hat as I type.

 

[mechBgon]

Originally posted by: SilentRunning
I am preparing my tin foil hat as I type.

Hehe

 

[VirtualLarry]

I'm surprised to hear that XP ships with a SafeDisc driver OOB, I thought that it was normally installed once you installed some DRMed game or something.

 

[Schadenfroh]

Microsoft has issued their official patches:

XP 32
http://www.microsoft.com/downl...15e5317&DisplayLang=en

XP 64
http://www.microsoft.com/downl...7da69aa&DisplayLang=en

2k364
http://www.microsoft.com/downl...7daa0d7&DisplayLang=en

2k332
http://www.microsoft.com/downl...70b6b02&DisplayLang=en

 

[mechBgon]

Originally posted by: Schadenfroh
Microsoft has issued their official patches:

XP 32
http://www.microsoft.com/downl...15e5317&DisplayLang=en

XP 64
http://www.microsoft.com/downl...7da69aa&DisplayLang=en

2k364
http://www.microsoft.com/downl...7daa0d7&DisplayLang=en

2k332
http://www.microsoft.com/downl...70b6b02&DisplayLang=en

Sweet, thanks man OP updated!