RichFX Basic Player ActiveX Control Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	26573
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 25 2007 12:00AM
Updated:	Nov 27 2007 01:43PM
Credit:	Elazar Broad discovered these vulnerabilities.
Vulnerable:	RichFX RichFX Basic Player 1.1 + RealNetworks RealPlayer 11
Not Vulnerable:

RichFX Basic Player ActiveX Control Multiple Buffer Overflow Vulnerabilities

RichFX Basic Player ActiveX Control is prone a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

Note that RichFX Player ActiveX Control is installed by default with RealNetworks RealPlayer. It may be shipped with other RealNetworks products as well.

RichFX Basic Player ActiveX Control Multiple Buffer Overflow Vulnerabilities

The following proof-of-concept code is available:

• /data/vulnerabilities/exploits/26573.html

RichFX Basic Player ActiveX Control Multiple Buffer Overflow Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

RichFX Basic Player ActiveX Control Multiple Buffer Overflow Vulnerabilities

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• RealPlayer Homepage (Real Networks )
  
• RichFX Homepage (RichFX)