CVE-2018-6547 in plays.tv Service
Summary
by MITRE
plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming Evolved products, contains an HTTP message parsing function that takes a user-defined path and writes non-user controlled data as SYSTEM to the file when the extract_files parameter is used. This occurs without properly authenticating the user.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/25/2020
The vulnerability identified as CVE-2018-6547 affects the plays_service.exe component within AMD's Gaming Evolved platform and driver packages, specifically versions prior to 1.27.7.0. This issue resides within the service's HTTP message parsing functionality where the software processes user-defined paths during file extraction operations. The flaw represents a critical security oversight that allows unauthorized file system modifications with elevated privileges. The vulnerability stems from inadequate input validation and authentication mechanisms within the service's file handling routines, creating a path traversal condition that can be exploited by malicious actors.
The technical implementation of this vulnerability involves the plays_service.exe process executing with SYSTEM privileges while processing HTTP requests containing user-supplied paths. When the extract_files parameter is utilized, the service accepts user-defined file paths without proper sanitization or authentication checks. This allows an attacker to specify arbitrary file locations within the system's file structure, enabling the service to write data to locations that should be restricted to authorized users. The vulnerability is classified under CWE-22 as a path traversal attack, where the service fails to properly validate user input before processing file operations. The service operates with elevated privileges, making the impact significantly more severe than typical path traversal vulnerabilities.
Operationally, this vulnerability creates a severe attack surface for privilege escalation and arbitrary code execution within the target system. An attacker who can send specially crafted HTTP requests to the plays_service.exe process can write arbitrary files to critical system locations, potentially including system directories, registry locations, or other protected areas. The lack of user authentication during file extraction operations means that any user with network access to the service can exploit this vulnerability. This represents a direct violation of the principle of least privilege and creates opportunities for persistent backdoors, system compromise, or data exfiltration. The vulnerability aligns with ATT&CK technique T1059.007 for command and script injection, as well as T1068 for exploit for privilege escalation, through the use of the service's elevated privileges for unauthorized file system modifications.
The mitigation strategy for CVE-2018-6547 requires immediate patching of all affected AMD driver packages and Gaming Evolved applications to version 1.27.7.0 or later. System administrators should also implement network segmentation to restrict access to the plays_service.exe process and monitor for unauthorized HTTP traffic to the affected service ports. Additional protective measures include implementing application whitelisting policies to prevent execution of unauthorized binaries and conducting comprehensive security audits of all AMD-related services. Organizations should also establish monitoring procedures for file system modifications in sensitive directories, as this vulnerability can be used to establish persistence within compromised systems. The fix addresses the root cause by implementing proper input validation and authentication checks within the HTTP message parsing function, ensuring that user-supplied paths are properly sanitized before any file operations are performed.