Security issue found in SunnComm's MediaMax DRM software

December 8, 2005

It looks
like the security issues with Sony's copy protection are no longer limited to just XCP, as now a
security flaw has been found in its SunnComm MediaMax software. The flaw basically allows a user with non-administrative privileges to a PC to run software with full system access by simply replacing the MMX.exe program in the "SunnComm Shared" folder with a program of their choice to run with administrative rights. This is automatically executed the next time a MediaMax CD is loaded.

Apparently, when the MediaMax software is installed, its shared folder is given the "Everyone" user group with full access rights to the directory and this Access Control List (ACL) is reset each time the disc is loaded. While this may not seem like much of an issue with home users, this can be particularly an issue with businesses, universities or elsewhere were users with standard privileges may have access to PCs with those with administrative rights or can remotely access the hard drive of a PC they wish to target (where the MediaMax software is installed).

Sony has released an updated version of MediaMax, which can be obtained here. The page also provides a link to a tool to remove the MediaMax software. Thanks to our system administrator, Liggy for letting us know about this news:

The security issue is caused due to insecure default directory ACLs being set on the "SunnComm Shared" directory, which allows "everyone" full access to the directory. This can be exploited by non-administrative users to modify the installed files, and potentially gain escalated privileges by e.g. replacing the MMX.exe program with a malicious program. The MMX.exe program will be automatically executed when another user inserts a MediaMax protected CD.

Changing the directory ACL manually is reportedly not effective as the insecure permissions will be restored the next time a MediaMax protected CD is played.

The security issue has been reported in version 5.0.21.0. Prior versions may also be affected.

With so many consumers now against Audio CD
copy-protection software, especially from Sony, it is really not much of a
surprise for someone to come across a security flaw in SunnComm's MediaMax
software that Sony also uses. Another problem is that even if a user loads
a CD infected with MediaMax without agreeing to its EULA, the software is still automatically installed, however at least Sony and SunnComm now offer a tool to remove it.

On the other hand, in order to make use of this security flaw, at least one user with administrative rights must insert a MediaMax protected CD before an unprivileged user can exploit it. So if an unprivileged user attempts to play a MediaMax disc for the first time on a PC, the software will not install, not to mention being prevented from playing back the disc either!

Liggy added: After having all the trouble with XCP it seems to be about time to deal with their MediaMax software which seems to be anything but safe for users. Looks like it is better not to insert a DRM protected CD into your drive or even better not to buy this crap at all.

Source: Secunia - Advisories