Real Networks RealPlayer Malformed IVR Pointer Index Remote Code Execution Vulnerability

Bugtraq ID:	44440
Class:	Unknown
CVE:	CVE-2010-2998
Remote:	Yes
Local:	No
Published:	Oct 15 2010 12:00AM
Updated:	Oct 15 2010 12:00AM
Credit:	Anonymous researchers working with TippingPoint's Zero Day Initiative
Vulnerable:	RealNetworks RealPlayer SP 1.0.1 RealNetworks RealPlayer SP 1.0 RealNetworks RealPlayer 11 Beta 6.0.14 .550 RealNetworks RealPlayer 11.0.5 RealNetworks RealPlayer 11.0.4 RealNetworks RealPlayer 11.0.3 RealNetworks RealPlayer 11.0.2 RealNetworks RealPlayer 11.0.1 RealNetworks RealPlayer 11.1 RealNetworks RealPlayer 11 Beta RealNetworks RealPlayer 11
Not Vulnerable:

Real Networks RealPlayer Malformed IVR Pointer Index Remote Code Execution Vulnerability

Real Networks RealPlayer is prone to a remote code-execution vulnerability.

Successful exploits will allow remote attackers to execute arbitrary code within the context of the affected application. Other attacks may also be possible.

NOTE: This issue was previously discussed in BID 44144 (Real Networks RealPlayer SP and RealPlayer Enterprise Multiple Security Vulnerabilities) but has been given its own records to better document it.

Real Networks RealPlayer Malformed IVR Pointer Index Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Real Networks RealPlayer Malformed IVR Pointer Index Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for details.

Real Networks RealPlayer Malformed IVR Pointer Index Remote Code Execution Vulnerability

References:

• RealPlayer Homepage (Real Networks )
  
• RealNetworks, Inc. Releases Update to Address Security Vulnerabilities. (Real Networks)
  
• ZDI-10-209 RealNetworks RealPlayer Malformed IVR Pointer Index Remote Code Execu (ZDI)