More flaws: Sony's latest patch comes unstuck

Sony BMG is replacing a patch for its CD copy protection software after Princeton University researchers found a security flaw in the update.

Sony announced on Tuesday that a new risk had been found with a batch of 27 of its CDs, which automatically install anti-piracy software on hard drives when put into a computer's CD drive. Along with the Electronic Frontier Foundation, a digital rights group, the record label released a patch aimed at fixing that flaw.

However, Princeton computer science professor Ed Felten wrote in his blog on Wednesday that the patch itself could open computers to attack by hackers.

Sony executives said on Thursday they are working as closely as possible with security professionals to address the issues identified by Felten, and would have a new patch available by midday that day.

Thomas Hesse, president of Sony's global digital businesses, said: "The security space is a dynamic one, as we have learned. Our goal is to be diligent and swift, and we have gone to experts to handle this issue."

Sony's ongoing troubles with copy-protection software highlight the delicate line that record labels and other content companies are walking in trying to protect their products from widespread duplication.

On the one hand, labels have watched their revenues decrease over the past few years, as more people swap songs online and burn CDs for friends and acquaintances.

However, the labels' technological attempts to create a copy-protected CD that retains compatibility with millions of old CD players have opened them up to the unfamiliar hazards of software development. Several of Sony's attempts to patch security holes in its anti-piracy software over the past few weeks have turned out to raise their own new problems, instead of quelling concerns.

The current security flaw in Sony's CDs is related to software produced by SunnComm Technologies and affects 27 titles that remain on the market.

It's separate from an earlier vulnerability that affected 52 other titles and which related to anti-piracy software written by another company, First 4 Internet. Those titles have been recalled from store shelves.

The flaw found by Felten could allow Sony's original patch to trigger malicious software on a computer, if that software was already in place when the patch was installed.

John Borland writes for CNET News.com