RealNetworks RealPlayer Unspecified Malformed Image Skin File Buffer Overflow Vulnerability
BID:15398
CVE-2005-3677 |Info
RealNetworks RealPlayer Unspecified Malformed Image Skin File Buffer Overflow Vulnerability
| Bugtraq ID: | 15398 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2005-3677 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 12 2005 12:00AM |
| Updated: | Nov 12 2005 12:00AM |
| Credit: | Discovery is credited to John Heasman of NGSSoftware. |
| Vulnerable: |
RealNetworks RealPlayer 10.5 v6.0.12.1235 RealNetworks RealPlayer 10.5 v6.0.12.1069 RealNetworks RealPlayer 10.5 v6.0.12.1059 RealNetworks RealPlayer 10.5 v6.0.12.1056 RealNetworks RealPlayer 10.5 v6.0.12.1053 RealNetworks RealPlayer 10.5 v6.0.12.1040 RealNetworks RealPlayer 10.0 |
| Not Vulnerable: | |
Discussion
RealNetworks RealPlayer Unspecified Malformed Image Skin File Buffer Overflow Vulnerability
RealNetworks RealPlayer is prone to an unspecified vulnerability that may let remote attackers execute arbitrary code.
This issue may be triggered by a malformed image in a skin file. The cause of the issue is reportedly a stack-based buffer overflow. It is possible to exploit this issue by enticing a victim user to open a malicious skin file containing a malformed image.
This affects some RealPlayer 10/10.5 releases on Windows platforms.
RealNetworks RealPlayer is prone to an unspecified vulnerability that may let remote attackers execute arbitrary code.
This issue may be triggered by a malformed image in a skin file. The cause of the issue is reportedly a stack-based buffer overflow. It is possible to exploit this issue by enticing a victim user to open a malicious skin file containing a malformed image.
This affects some RealPlayer 10/10.5 releases on Windows platforms.
Exploit / POC
RealNetworks RealPlayer Unspecified Malformed Image Skin File Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
RealNetworks RealPlayer Unspecified Malformed Image Skin File Buffer Overflow Vulnerability
Solution:
The vendor has released fixes to address this issue. The patches are available through the 'Check for Update' functionality of the software under the 'Tools' menu. Fixes are available from the following location as well:
http://service.real.com/realplayer/security/
Solution:
The vendor has released fixes to address this issue. The patches are available through the 'Check for Update' functionality of the software under the 'Tools' menu. Fixes are available from the following location as well:
http://service.real.com/realplayer/security/
References
RealNetworks RealPlayer Unspecified Malformed Image Skin File Buffer Overflow Vulnerability
References:
References:
- RealNetworks, Inc. Releases Update to Address Security Vulnerabilities. (Real Networks)
- High Risk Flaw in RealPlayer ("NGSSoftware Insight Security Research"