RealNetworks RealOne Player/RealPlayer Unspecified WAV File Processing Buffer Overflow Vulnerability

Bugtraq ID:	12697
Class:	Boundary Condition Error
CVE:	CVE-2005-0611
Remote:	Yes
Local:	No
Published:	Mar 01 2005 12:00AM
Updated:	Jul 12 2009 10:56AM
Credit:	Discovery of this vulnerability is credited to Mark Litchfield of NGSSoftware.
Vulnerable:	Redhat Enterprise Linux WS 3 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux AS 3 Redhat Desktop 3.0 RealNetworks RealPlayer For Unix 10.0.3 + S.u.S.E. Linux Personal 9.3 + S.u.S.E. Linux Personal 9.2 RealNetworks RealPlayer Enterprise 1.6 RealNetworks RealPlayer Enterprise 1.5 RealNetworks RealPlayer Enterprise 1.2 RealNetworks RealPlayer Enterprise 1.1 RealNetworks RealPlayer Enterprise RealNetworks RealPlayer 10 for Mac OS 10.0.0.325 RealNetworks RealPlayer 10 for Mac OS 10.0.0.305 RealNetworks RealPlayer 10 for Mac OS RealNetworks RealPlayer 10 for Linux RealNetworks RealPlayer 10.5 v6.0.12.1056 RealNetworks RealPlayer 10.5 v6.0.12.1053 RealNetworks RealPlayer 10.5 v6.0.12.1040 RealNetworks RealPlayer 10.0 + S.u.S.E. cvsup-16.1h-43.i586.rpm + S.u.S.E. Linux Personal 9.3 + S.u.S.E. Linux Personal 9.2 RealNetworks RealPlayer 8.0 Win32 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 SP1 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows XP Home - Microsoft Windows XP Professional RealNetworks RealPlayer 8.0 Unix - Caldera OpenLinux Workstation 3.1 - Debian Linux 2.2 IA-32 - Debian Linux 2.2 alpha - HP HP-UX 11.11 - HP HP-UX 11.0 - IBM AIX 4.3.3 - IBM AIX 4.3.2 - IBM AIX 4.3.1 - IBM AIX 4.3 - IBM AIX 4.2.1 - IBM AIX 4.2 - Mandriva Linux Mandrake 8.0 - Mandriva Linux Mandrake 7.2 - Redhat Linux 7.2 i386 - Redhat Linux 7.1 i386 - Redhat Linux 7.0 i386 - Redhat Linux 6.2 sparc - Redhat Linux 6.2 i386 - Redhat Linux 6.2 alpha + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 8.2 - SCO eDesktop 2.4 - SGI IRIX 6.5.14 - SGI IRIX 6.5.13 m - SGI IRIX 6.5.13 f - SGI IRIX 6.5.13 - SGI IRIX 6.5.12 m - SGI IRIX 6.5.12 f - SGI IRIX 6.5.12 - SGI IRIX 6.5.11 m - SGI IRIX 6.5.11 f - SGI IRIX 6.5.11 - SGI IRIX 6.3 - Slackware Linux 8.0 - Slackware Linux 7.1 - Slackware Linux 7.0 - Sun Solaris 7.0 - Sun Solaris 2.6 + SuSE Linux 8.1 - SuSE Linux 7.2 i386 - SuSE Linux 7.1 x86 - SuSE Linux 7.1 - SuSE Linux 7.0 i386 + SuSE Linux Desktop 1.0 RealNetworks RealPlayer 8.0 Mac RealNetworks RealOne Player for OSX 9.0 .297 RealNetworks RealOne Player for OSX 9.0 .288 RealNetworks RealOne Player 6.0.11 .872 RealNetworks RealOne Player 6.0.11 .868 RealNetworks RealOne Player 6.0.11 .853 RealNetworks RealOne Player 6.0.11 .841 RealNetworks RealOne Player 6.0.11 .840 RealNetworks RealOne Player 6.0.11 .830 RealNetworks RealOne Player 6.0.11 .818 RealNetworks RealOne Player 1.0 RealNetworks Helix Player for Linux 1.0
Not Vulnerable:	RealNetworks RealPlayer 10 for Mac OS 10.0 .0.331 RealNetworks RealPlayer 10.5 v6.0.12.1059

RealNetworks RealOne Player/RealPlayer Unspecified WAV File Processing Buffer Overflow Vulnerability

RealNetworks RealPlayer and RealOne Player are reported prone to an unspecified buffer overflow vulnerability. It is reported that the issue manifests when a malicious WAV file is processed. The vulnerability affects heap-based memory.

A remote attacker may exploit this vulnerability to execute arbitrary code in the context of a user that uses a vulnerable version of the media player to play a malicious WAV file.

RealNetworks RealOne Player/RealPlayer Unspecified WAV File Processing Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

RealNetworks RealOne Player/RealPlayer Unspecified WAV File Processing Buffer Overflow Vulnerability

Solution:
SuSE has released advisory SUSE-SA:2005:014 to address this issue. Please see the attached advisory for details on obtaining and applying fixes.

The vendor has released updates dealing with this issue. Please see the referenced advisory for more information on obtaining the updated packages.

Updates may be applied from within the software by selecting the Check For Update option from the Tools menu.

Red Hat has released advisory RHSA-2005:299-06 containing RealPlayer 10 packages for Red Hat Enterprise Linux 3. Please see the advisory in Web references for more information.


RealNetworks RealPlayer For Unix 10.0.3

• SuSE RealPlayer-10.0.3-0.1.i586.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/RealPlayer-10.0.3 -0.1.i586.rpm

RealNetworks RealOne Player/RealPlayer Unspecified WAV File Processing Buffer Overflow Vulnerability

References:

• Home Page (Real Networks)
  
• RealNetworks Releases Security Update to Address RealOne Player Security (Real Networks)
  
• RealNetworks, Inc. Releases Update to Address Security Vulnerabilities. (Real Networks)
  
• RHSA-2005:299-06 - realplayer security update (RedHat)
  
• RealOne Player / Real .WAV Heap Overflow File Format Vulnerability ("Mark Litchfield" )