vulnwire
6.9med

CVE-2007-55871 exploit

Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professional x64 and x64 SP2…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
6.9
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.9%
percentile 87%
Public exploits
1
Exploit-DB

Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professional x64 and x64 SP2, Server 2003 SP1 and SP2, and Server 2003 x64 and x64 SP2 allows local users to overwrite arbitrary memory locations and gain privileges via a crafted argument to a METHOD_NEITHER IOCTL, as originally discovered in the wild.

Exploit prediction (EPSS)

2.90% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.

Exploits and detections

  • EDB-30680 Macrovision SafeDisc - 'SecDRV.SYS' Method_Neither Privilege Escalation · local · 2007-10-18

CVSS scores

Assigned byVersionScoreVector
NVD2.06.9AV:L/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-264 Permissions, Privileges, and Access Controls

References

  • reversemode.com /index.php?option=com_mamblog&Itemid=15&task=show&action=view&id=43&Itemid=15 · x_refsource_MISC, x_transferred
  • blog.48bits.com /?p=172 · x_refsource_MISC, x_transferred
  • secunia.com /advisories/27285 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • microsoft.com /technet/security/advisory/944653.mspx · vendor-advisory, x_refsource_MSKB, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4584 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • vupen.com /english/advisories/2007/3537 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityfocus.com /archive/1/485268/100/0/threaded · vendor-advisory, x_refsource_HP, x_transferred
  • symantec.com /enterprise/security_response/weblog/2007/10/privilege_escalation_exploit_i.html · x_refsource_MISC, x_transferred
  • osvdb.org /41429 · vdb-entry, x_refsource_OSVDB, x_transferred
  • us-cert.gov /cas/techalerts/TA07-345A.html · third-party-advisory, x_refsource_CERT, x_transferred
  • securityfocus.com /archive/1/482482/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/37284 · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /archive/1/482474/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityreason.com /securityalert/3266 · third-party-advisory, x_refsource_SREASON, x_transferred
  • securitytracker.com /id?1018833 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securityfocus.com /bid/26121 · vdb-entry, x_refsource_BID, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2007/ms07-067 · vendor-advisory, x_refsource_MS, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.