Real Media RealPlayer SP/Enterprise ActiveX Control Remote Heap Buffer Overflow Vulnerability

Bugtraq ID:	44423
Class:	Boundary Condition Error
CVE:	CVE-2010-3751
Remote:	Yes
Local:	No
Published:	Oct 15 2010 12:00AM
Updated:	Oct 15 2010 12:00AM
Credit:	Anonymous researchers working with TippingPoint's Zero Day Initiativ
Vulnerable:	RealNetworks RealPlayer SP 1.1.4 RealNetworks RealPlayer SP 1.0.2 RealNetworks RealPlayer SP 1.0.1 RealNetworks RealPlayer SP 1.0 RealNetworks RealPlayer SP 1.1.3 RealNetworks RealPlayer SP 1.1.2 RealNetworks RealPlayer SP 1.1.1 RealNetworks RealPlayer SP 1.1 RealNetworks RealPlayer 11.0.5 RealNetworks RealPlayer 11.0.2 RealNetworks RealPlayer 11.0.1 RealNetworks RealPlayer 11
Not Vulnerable:	RealNetworks RealPlayer SP 1.1.5

Real Media RealPlayer SP/Enterprise ActiveX Control Remote Heap Buffer Overflow Vulnerability

Real Media RealPlayer SP/Enterprise is prone to a remote heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input before copying it to an insufficiently sized buffer.

A remote attacker may exploit this issue by enticing victims into opening a malicious HTML document.

Exploiting this issue allows the attacker to execute arbitrary code in the context of applications using the affected ActiveX control. Failed attempts will likely result in denial-of-service conditions.

NOTE: This issue was previously discussed in BID 44144 (Real Networks RealPlayer SP and RealPlayer Enterprise Multiple Security Vulnerabilities) but has been given its own records to better document it.

Real Media RealPlayer SP/Enterprise ActiveX Control Remote Heap Buffer Overflow Vulnerability

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• RealNetworks, Inc. Releases Update to Address Security Vulnerabilities. (Real Networks)
  
• RealPlayer Homepage (Real Networks )
  
• ZDI-10-213 RealNetworks RealPlayer Multiple Protocol Handlers Remote Code Execut (ZDI)