Is it legal for schools to publish SAT scores to the student body...

Yes, FERPA violation but it depends on whether a school that receives Federal funding or not.

If it is a private school, they can do what they want:
http://www2.ed.gov/policy/gen/guid/fpco/ferpa/parents.html