RealNetworks RealOne Player And RealPlayer Multiple Potential Vulnerabilities
BID:12315
Info
RealNetworks RealOne Player And RealPlayer Multiple Potential Vulnerabilities
| Bugtraq ID: | 12315 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 20 2005 12:00AM |
| Updated: | Jan 20 2005 12:00AM |
| Credit: | Discovery is credited to NGSSoftware Insight Security Research <[email protected]>. |
| Vulnerable: |
RealNetworks RealPlayer 10 Japanese RealNetworks RealPlayer 10 German RealNetworks RealPlayer 10 English RealNetworks RealPlayer 10.5 v6.0.12.1040 RealNetworks RealPlayer 10.5 Beta v6.0.12.1016 RealNetworks RealPlayer 10.5 RealNetworks RealPlayer 10.0 BETA RealNetworks RealPlayer 10.0 v6.0.12.690 RealNetworks RealOne Player 2.0 RealNetworks RealOne Player 1.0 |
| Not Vulnerable: |
RealNetworks RealPlayer for Palm OS RealNetworks RealPlayer 10 for Mac OS RealNetworks RealPlayer 10.5 v6.0.12.1053 RealNetworks RealOne Player for Palm OS RealNetworks Helix Player for Linux 1.0 |
Discussion
RealNetworks RealOne Player And RealPlayer Multiple Potential Vulnerabilities
RealNetworks RealOne Player And RealPlayer are reported prone to multiple potential vulnerabilities. These issues may allow an attacker to potentially execute arbitrary code or disclose the presence of files on a vulnerable computer.
The following specific issues were identified:
The first issue presents itself when the application processes Real Metadata Package files containing malformed tags. The researchers responsible for discovering this issue have reported that this issue may not be exploitable and represents a potential threat.
The second issue may allow attacker to determine the existence of files on a vulnerable computer. The validity of this issue is not confirmed at the moment is also considered a potential threat.
It is likely that this issues were originally released as unspecified vulnerabilities. This cannot be confirmed at the moment, however, one of the BIDs will be retired, if it turns out that the BIDs represent the same issues.
RealNetworks RealOne Player And RealPlayer are reported prone to multiple potential vulnerabilities. These issues may allow an attacker to potentially execute arbitrary code or disclose the presence of files on a vulnerable computer.
The following specific issues were identified:
The first issue presents itself when the application processes Real Metadata Package files containing malformed tags. The researchers responsible for discovering this issue have reported that this issue may not be exploitable and represents a potential threat.
The second issue may allow attacker to determine the existence of files on a vulnerable computer. The validity of this issue is not confirmed at the moment is also considered a potential threat.
It is likely that this issues were originally released as unspecified vulnerabilities. This cannot be confirmed at the moment, however, one of the BIDs will be retired, if it turns out that the BIDs represent the same issues.
Exploit / POC
RealNetworks RealOne Player And RealPlayer Multiple Potential Vulnerabilities
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
RealNetworks RealOne Player And RealPlayer Multiple Potential Vulnerabilities
Solution:
The vendor has released updates dealing with this issue. Please see the referenced advisory for more information on obtaining the updated packages.
Solution:
The vendor has released updates dealing with this issue. Please see the referenced advisory for more information on obtaining the updated packages.
References
RealNetworks RealOne Player And RealPlayer Multiple Potential Vulnerabilities
References:
References:
- Home Page (Real Networks)
- RealNetworks, Inc. Releases Update to Address Security Vulnerabilities. (Real Networks)
- RealPlayer Miscellaneous Vulnerabilities (#NISR19012005g) ("NGSSoftware Insight Security Research"