RealPlayer/HelixPlayer ParseWallClockValue Function Buffer Overflow Vulnerability
BID:24658
Info
RealPlayer/HelixPlayer ParseWallClockValue Function Buffer Overflow Vulnerability
| Bugtraq ID: | 24658 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-3410 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 26 2007 12:00AM |
| Updated: | Mar 13 2008 04:01AM |
| Credit: | The reporter of this issue wishes to remain anonymous. |
| Vulnerable: |
Redhat Enterprise Linux WS 4 Redhat Enterprise Linux Extras 4 Redhat Enterprise Linux Extras 3 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux Desktop Supplementary 5 client Redhat Enterprise Linux AS 4 Redhat Enterprise Linux Desktop version 4 RealNetworks RealPlayer Enterprise RealNetworks RealPlayer 10 for Mac OS 10.0 .0.331 RealNetworks RealPlayer 10 for Mac OS 10.0.0.412 RealNetworks RealPlayer 10 for Mac OS 10.0.0.396 RealNetworks RealPlayer 10 for Mac OS 10.0.0.352 RealNetworks RealPlayer 10 for Mac OS 10.0.0.305 RealNetworks RealPlayer 10 for Linux 10.0.8 RealNetworks RealPlayer 10 for Linux 10.0.7 RealNetworks RealPlayer 10 for Linux 10.0.6 RealNetworks RealPlayer 10 for Linux 10.0.5 RealNetworks RealPlayer 10.5-GOLD RealNetworks RealOne Player for Mac 0 RealNetworks RealOne Player 1.0 RealNetworks HelixPlayer 10.5 - GOLD RealNetworks Helix Player for Linux 10.0.7 RealNetworks Helix Player for Linux 10.0.6 RealNetworks Helix Player for Linux 10.0.5 Gentoo Linux |
| Not Vulnerable: | |
Discussion
RealPlayer/HelixPlayer ParseWallClockValue Function Buffer Overflow Vulnerability
RealPlayer and HelixPlayer are prone to a buffer-overflow vulnerability because the applications fail to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.
RealPlayer and HelixPlayer are prone to a buffer-overflow vulnerability because the applications fail to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.
Exploit / POC
RealPlayer/HelixPlayer ParseWallClockValue Function Buffer Overflow Vulnerability
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following proof-of-concept code is available:
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following proof-of-concept code is available:
Solution / Fix
RealPlayer/HelixPlayer ParseWallClockValue Function Buffer Overflow Vulnerability
Solution:
The vendor released updates to address this issue. Please see the references for more information.
Solution:
The vendor released updates to address this issue. Please see the references for more information.
References
RealPlayer/HelixPlayer ParseWallClockValue Function Buffer Overflow Vulnerability
References:
References:
- RealNetworks, Inc. Releases Update to Address Security Vulnerabilities. (Real Networks )
- RealPlayer Homepage (Real Networks)
- RHSA-2007:0841-7 - Critical: RealPlayer security update (RedHat)
- VU#770904 (US-CERT)
- iDefense Security Advisory 06.26.07: RealNetworks RealPlayer/HelixPlayer SMIL wa ([email protected])
- RealNetworks RealPlayer/HelixPlayer SMIL wallclock Stack Overflow Vulnerability (iDefense Labs)
- Red Hat Security Advisory RHSA-2007:0605-3: HelixPlayer security update (Red Hat)