‘RealPlayer Sound Data Handling Buffer Overflow Vulnerability’

Summary

RealPlayer contains a vulnerability in Sound Data within media files which could be exploited by remote attackers.’

Credit:

‘The information has been provided by Nicolas Joly.
The original article can be found at: http://seclists.org/bugtraq/2010/Dec/113


Details

Vulnerable Systems:
 * RealPlayer 11.0 – 11.1
 * RealPlayer SP 1.0 – 1.0.1
 * RealPlayer SP 1.0.2 – 1.1.1
 * RealPlayer SP 1.1.2 – 1.1.4
 * RealPlayer Enterprise 2.1.2
 * Mac RealPlayer 11.0 – 11.1
 * Linux RealPlayer 11.0.2.1744

Immune Systems:
 * RealPlayer 14.0.0
 * RealPlayer Enterprise 2.1.4
 * Mac RealPlayer 12.0.0.1548
 * Linux RealPlayer 11.0.2.2315

The vulnerability is caused by a heap overflow error when handling sound data within media files, which could be exploited by remote attackers to execute arbitrary code by tricking a user into visiting a specially crafted web page.

Disclosure Timeline:
2010-02-25 – Vendor notified
2010-12-05 – Status update received
2010-12-10 – Coordinated disclosure’

Categories: News