Other Sony software products that utilize the Gracenote CD database lookup features do not contain this security issue. This issue only affects the Sony software products listed below. If you use any of the Sony music management software listed below (e.g., in connection with a VAIO computer or with a Walkman portable music player), we recommend that you download the Gracenote Update and install it on your PC.
However, we take all security issues very seriously. This 'buffer overflow' vulnerability could allow an attacker to load malicious code onto a user's system and then execute the code.Īs of the date of this update, neither Sony nor Gracenote has received reports of any customers being adversely impacted by this issue. The Gracenote CDDB lookup service provides information such as artist, title, tracklist and other music-related information in software applications. Recently, a security vulnerability has been found associated with the Gracenote CDDB (CD Database) service utilized by certain Sony software applications.
Sony's e-mail announcement included some details regarding the security hole:
