CVE-2007-5587
published 2007-10-19CVE-2007-5587: Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professional x64 and x64 SP2, Server 2003 SP1…
PriorityP179medium6.9CVSS 2.0
AVLACMAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
2.90%
85.2th percentile
Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professional x64 and x64 SP2, Server 2003 SP1 and SP2, and Server 2003 x64 and x64 SP2 allows local users to overwrite arbitrary memory locations and gain privileges via a crafted argument to a METHOD_NEITHER IOCTL, as originally discovered in the wild.
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for crafted METHOD_NEITHER IOCTL calls targeting secdrv.sys, which can be used to overwrite arbitrary memory and escalate privileges to SYSTEM. ↗
- →Alert on local processes interacting with secdrv.sys driver via IOCTL on Windows XP and Server 2003 platforms; Vista is not affected. ↗
- ·Vulnerability is only exploitable on Windows XP and Server 2003; Windows Vista is not affected, limiting detection scope. ↗
- ·The vulnerable driver version is secdrv.sys before 4.3.86.0; detections should be scoped to this version range. ↗
CVSS provenance
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
vulncheck6.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f6r6-w5wr-6658: Buffer overflow in Macrovision SafeDisc secdrv
ghsa_unreviewed·2022-05-01
CVE-2007-5587 [MEDIUM] CWE-119 GHSA-f6r6-w5wr-6658: Buffer overflow in Macrovision SafeDisc secdrv
Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professional x64 and x64 SP2, Server 2003 SP1 and SP2, and Server 2003 x64 and x64 SP2 allows local users to overwrite arbitrary memory locations and gain privileges via a crafted argument to a METHOD_NEITHER IOCTL, as originally discovered in the wild.
VulnCheck
Microsoft Windows Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2007·CVSS 6.9
CVE-2007-5587 [MEDIUM] Microsoft Windows Improper Restriction of Operations within the Bounds of a Memory Buffer
Microsoft Windows Improper Restriction of Operations within the Bounds of a Memory Buffer
Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professional x64 and x64 SP2, Server 2003 SP1 and SP2, and Server 2003 x64 and x64 SP2 allows local users to overwrite arbitrary memory locations and gain privileges via a crafted argument to a METHOD_NEITHER IOCTL, as originally discovered in the wild.
Affected: Microsoft Windows
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-067
No detection rules found.
No writeups or analysis indexed.
http://blog.48bits.com/?p=172http://osvdb.org/41429http://secunia.com/advisories/27285http://securityreason.com/securityalert/3266http://www.microsoft.com/technet/security/advisory/944653.mspxhttp://www.reversemode.com/index.php?option=com_mamblog&Itemid=15&task=show&action=view&id=43&Itemid=15http://www.securityfocus.com/archive/1/482474/100/0/threadedhttp://www.securityfocus.com/archive/1/482482/100/0/threadedhttp://www.securityfocus.com/archive/1/485268/100/0/threadedhttp://www.securityfocus.com/bid/26121http://www.securitytracker.com/id?1018833http://www.symantec.com/enterprise/security_response/weblog/2007/10/privilege_escalation_exploit_i.htmlhttp://www.us-cert.gov/cas/techalerts/TA07-345A.htmlhttp://www.vupen.com/english/advisories/2007/3537https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-067https://exchange.xforce.ibmcloud.com/vulnerabilities/37284https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4584http://blog.48bits.com/?p=172http://osvdb.org/41429http://secunia.com/advisories/27285http://securityreason.com/securityalert/3266http://www.microsoft.com/technet/security/advisory/944653.mspxhttp://www.reversemode.com/index.php?option=com_mamblog&Itemid=15&task=show&action=view&id=43&Itemid=15http://www.securityfocus.com/archive/1/482474/100/0/threadedhttp://www.securityfocus.com/archive/1/482482/100/0/threadedhttp://www.securityfocus.com/archive/1/485268/100/0/threadedhttp://www.securityfocus.com/bid/26121http://www.securitytracker.com/id?1018833http://www.symantec.com/enterprise/security_response/weblog/2007/10/privilege_escalation_exploit_i.htmlhttp://www.us-cert.gov/cas/techalerts/TA07-345A.htmlhttp://www.vupen.com/english/advisories/2007/3537https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-067https://exchange.xforce.ibmcloud.com/vulnerabilities/37284https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4584
2007-10-19
Published
Exploited in the wild