RealNetworks RealPlayer Drag And Drop Zone Bypass Vulnerability

Bugtraq ID:	12410
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 01 2005 12:00AM
Updated:	Feb 01 2005 12:00AM
Credit:	"[email protected]" <[email protected]> disclosed this vulnerability.
Vulnerable:	RealNetworks RealPlayer Enterprise RealNetworks RealPlayer 10.5 v6.0.12.1069 RealNetworks RealPlayer 10.5 v6.0.12.1059 RealNetworks RealPlayer 10.5 v6.0.12.1056 RealNetworks RealPlayer 10.5 v6.0.12.1053 RealNetworks RealPlayer 10.5 v6.0.12.1040 RealNetworks RealPlayer 10.5 Beta v6.0.12.1016 RealNetworks RealPlayer 10.5 RealNetworks RealPlayer 10.0 + S.u.S.E. cvsup-16.1h-43.i586.rpm + S.u.S.E. Linux Personal 9.3 + S.u.S.E. Linux Personal 9.2 RealNetworks RealPlayer 8.0 Win32 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 SP1 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows XP Home - Microsoft Windows XP Professional RealNetworks RealOne Player 2.0 RealNetworks RealOne Player 1.0
Not Vulnerable:

RealNetworks RealPlayer Drag And Drop Zone Bypass Vulnerability

RealNetworks RealPlayer is reported susceptible to a security zone bypass vulnerability. This issue is due to a failure of the application to properly enforce security zones, potentially allowing remote attackers to execute HTML or script code in the Local Zone of affected client computers.

The embedded Internet Explorer engine in RealPlayer reportedly loads attacker-supplied files in the Local Zone, allowing attackers to execute malicious HTML and script code with potentially elevated privileges. This issue may be a variant, or be related to BIDs 10973, or 11466.

It is unclear at this time if a further vulnerability has been discovered by this disclosure. This BID will be updated as further analysis is completed.

RealNetworks RealPlayer Drag And Drop Zone Bypass Vulnerability

A web site containing proof of concept code is located at:

http://www.malware.com/reelcigar.html

RealNetworks RealPlayer Drag And Drop Zone Bypass Vulnerability

Solution:
The vendor has released an advisory and fixes to address this issue. Please see the referenced advisory for further information.

RealNetworks RealPlayer Drag And Drop Zone Bypass Vulnerability

References:

• Real Networks Support: Security Issues (Real Networks)
  
• RealNetworks, Inc. Releases Update to Address Security Vulnerabilities (RealNetworks)
  
• RealPlayer Homepage (Real Networks)
  
• SAME LADY, DIFFERENT HAT: REELY ("[email protected] " <[email protected]>)