RealNetworks RealOne Player And RealPlayer PNen3260.DLL Remote Integer Overflow Vulnerability

Bugtraq ID:	11309
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 29 2004 12:00AM
Updated:	Sep 29 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Karl Lynn of eEye Digital Security.
Vulnerable:	RealNetworks RealPlayer Enterprise RealNetworks RealPlayer 8 RealNetworks RealPlayer 10 for Mac OS Beta RealNetworks RealPlayer 10 for Linux RealNetworks RealPlayer 10 Japanese RealNetworks RealPlayer 10 German RealNetworks RealPlayer 10 English RealNetworks RealPlayer 10.5 v6.0.12.1040 RealNetworks RealPlayer 10.5 Beta v6.0.12.1016 RealNetworks RealPlayer 10.5 RealNetworks RealPlayer 10.0 BETA RealNetworks RealPlayer 10.0 v6.0.12.690 RealNetworks RealPlayer 10.0 + S.u.S.E. cvsup-16.1h-43.i586.rpm + S.u.S.E. Linux Personal 9.3 + S.u.S.E. Linux Personal 9.2 RealNetworks RealPlayer 8.0 Win32 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 SP1 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows XP Home - Microsoft Windows XP Professional RealNetworks RealPlayer 8.0 Unix - Caldera OpenLinux Workstation 3.1 - Debian Linux 2.2 IA-32 - Debian Linux 2.2 alpha - HP HP-UX 11.11 - HP HP-UX 11.0 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - IBM AIX 4.3 - IBM AIX 4.2.1 - IBM AIX 4.2 - Mandriva Linux Mandrake 8.0 - Mandriva Linux Mandrake 7.2 - Redhat Linux 7.2 i386 - Redhat Linux 7.1 i386 - Redhat Linux 7.0 i386 - Redhat Linux 6.2 sparc - Redhat Linux 6.2 i386 - Redhat Linux 6.2 alpha + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 8.2 - SCO eDesktop 2.4 - SGI IRIX 6.5.14 - SGI IRIX 6.5.13 m - SGI IRIX 6.5.13 f - SGI IRIX 6.5.13 - SGI IRIX 6.5.12 m - SGI IRIX 6.5.12 f - SGI IRIX 6.5.12 - SGI IRIX 6.5.11 m - SGI IRIX 6.5.11 f - SGI IRIX 6.5.11 - SGI IRIX 6.3 - Slackware Linux 8.0 - Slackware Linux 7.1 - Slackware Linux 7.0 - Sun Solaris 7.0 - Sun Solaris 2.6 + SuSE Linux 8.1 - SuSE Linux 7.2 i386 - SuSE Linux 7.1 x86 - SuSE Linux 7.1 - SuSE Linux 7.0 i386 + SuSE Linux Desktop 1.0 RealNetworks RealPlayer 8.0 Mac RealNetworks RealOne Player for OSX 9.0 .297 RealNetworks RealOne Player for OSX 9.0 .288 RealNetworks RealOne Player 2.0 RealNetworks RealOne Player 1.0 RealNetworks Helix Player for Linux 1.0
Not Vulnerable:	RealNetworks RealPlayer for Palm OS RealNetworks RealPlayer 10.5 v6.0.12.1053 RealNetworks RealOne Player for Palm OS RealNetworks Helix Player for Symbian

RealNetworks RealOne Player And RealPlayer PNen3260.DLL Remote Integer Overflow Vulnerability

RealPlayer and RealOne Player are prone to a remote integer overflow vulnerability. It is reported that the vulnerability exists in the 'pnen3260.dll' linked library of both RealPlayer and RealOne Player for Microsoft Windows, Linux, and Mac OS platforms. The 'pnen3260.dll' library is responsible for processing real-media '.rm' files.

The overflow will cause the corruption of heap-based memory management structures. Ultimately this may permit an attacker to write to an arbitrary location in the memory of the active process and in doing so control execution flow.

A remote attacker may therefore exploit this vulnerability to execute arbitrary attacker-supplied instructions in the context of a user that is running a vulnerable version of the software.

This issue was originally described in BID 11273 (RealNetworks RealOne Player And RealPlayer Remote Vulnerabilities) and is now being assigned its own BID.

RealNetworks RealOne Player And RealPlayer PNen3260.DLL Remote Integer Overflow Vulnerability

The discoverer of this vulnerability has created a proof of concept exploit. This exploit is private and it is not believed that the exploit is in public circulation.

RealNetworks RealOne Player And RealPlayer PNen3260.DLL Remote Integer Overflow Vulnerability

Solution:
The vendor has released updates dealing with this issue. Please see the referenced advisory for more information on obtaining the updated packages.

SuSE Linux has released an advisory (SUSE-SA:2005:004) dealing with this issue. Please see the referenced advisory for more information.


RealNetworks RealPlayer 10 for Mac OS Beta

• Real Networks RealPlayer 10 for Mac OSX
  Real Networks RealOne Player
  http://www.real.com/upgrade/mac_upgrade.html

RealNetworks RealPlayer Enterprise

• Real Networks rmff3260.dll
  Real Networks RealPlayer Enterprise
  http://software-dl.real.com/sdk/rpe_sec_patch/rmff3260.dll

RealNetworks RealPlayer 10 for Linux

• Real Networks RealOne Player 10 for Linux
  Real Networks RealPlayer 10
  http://www.real.com/linux/

RealNetworks Helix Player for Linux 1.0

• Real Networks Helix Player for Linux
  Real Networks Helix Player
  https://player.helixcommunity.org/2004/downloads/

RealNetworks RealOne Player for OSX 9.0 .288

• Real Networks RealOne Player 10 for Mac OSX
  Real Networks RealPlayer Enterprise
  http://forms.real.com/real/player/blackjack.html


• Real Networks RealPlayer 10 for Mac OSX
  Real Networks RealOne Player
  http://www.real.com/upgrade/mac_upgrade.html

RealNetworks RealOne Player for OSX 9.0 .297

• Real Networks RealOne Player 10 for Mac OSX
  Real Networks RealPlayer Enterprise
  http://forms.real.com/real/player/blackjack.html


• Real Networks RealPlayer 10 for Mac OSX
  Real Networks RealOne Player
  http://www.real.com/upgrade/mac_upgrade.html

RealNetworks RealOne Player And RealPlayer PNen3260.DLL Remote Integer Overflow Vulnerability

References:

• Home Page (Real Networks)
  
• RealNetworks, Inc. Releases Update to Address Security Vulnerabilities. (Real Networks)
  
• EEYE: RealPlayer pnen3260.dll Heap Overflow (eEye Digital Security)