RealNetworks RealOne Player/RealPlayer Remote R3T File Stack Buffer Overflow Vulnerability
BID:10070
Info
RealNetworks RealOne Player/RealPlayer Remote R3T File Stack Buffer Overflow Vulnerability
| Bugtraq ID: | 10070 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 07 2004 12:00AM |
| Updated: | Apr 07 2004 12:00AM |
| Credit: | This issue was discovered by the people at NGSSoftware. |
| Vulnerable: |
RealNetworks RealPlayer 10.0 BETA RealNetworks RealPlayer 8.0 Win32 RealNetworks RealPlayer 8.0 Unix RealNetworks RealPlayer 8.0 Mac RealNetworks RealOne Player version 2.0 for Windows RealNetworks RealOne Player 6.0.11 .872 RealNetworks RealOne Player 6.0.11 .868 RealNetworks RealOne Player 6.0.11 .853 RealNetworks RealOne Player 6.0.11 .841 RealNetworks RealOne Player 6.0.11 .830 RealNetworks RealOne Player 6.0.11 .818 RealNetworks RealOne Player 2.0 RealNetworks RealOne Enterprise Desktop 6.0.11 .774 |
| Not Vulnerable: | |
Discussion
RealNetworks RealOne Player/RealPlayer Remote R3T File Stack Buffer Overflow Vulnerability
It has been reported that RealOne Player and RealPlayer are prone to a remote stack-based buffer overflow vulnerability. The issue is exposed when the software processes a malformed .R3T file. This issue is due to a failure of the application to properly validate string boundaries when copying user supplied input into finite buffers.
Successful exploitation would immediately produce a denial of service condition in the affected process. This issue may also be leveraged to execute code on the affected system with the privileges of the user that invoked the vulnerable application.
It has been reported that RealOne Player and RealPlayer are prone to a remote stack-based buffer overflow vulnerability. The issue is exposed when the software processes a malformed .R3T file. This issue is due to a failure of the application to properly validate string boundaries when copying user supplied input into finite buffers.
Successful exploitation would immediately produce a denial of service condition in the affected process. This issue may also be leveraged to execute code on the affected system with the privileges of the user that invoked the vulnerable application.
Exploit / POC
RealNetworks RealOne Player/RealPlayer Remote R3T File Stack Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
RealNetworks RealOne Player/RealPlayer Remote R3T File Stack Buffer Overflow Vulnerability
Solution:
Real Networks Inc. has released an advisory and fixes dealing with this issue. Please see the referenced web page for more information and details on obtaining fixes.
Solution:
Real Networks Inc. has released an advisory and fixes dealing with this issue. Please see the referenced web page for more information and details on obtaining fixes.
References
RealNetworks RealOne Player/RealPlayer Remote R3T File Stack Buffer Overflow Vulnerability
References:
References:
- REAL One Player R3T File Format Stack Overflow (NGSSoftware)
- RealNetworks, Inc. Releases Update to Address Security Vulnerability. (RealNetworks)