Real Networks RealPlayer SP and RealPlayer Enterprise Remote Code Execution Vulnerability
BID:44442
Info
Real Networks RealPlayer SP and RealPlayer Enterprise Remote Code Execution Vulnerability
| Bugtraq ID: | 44442 |
| Class: | Unknown |
| CVE: |
CVE-2010-3750 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 15 2010 12:00AM |
| Updated: | Oct 15 2010 12:00AM |
| Credit: | Sebastian Apelt |
| Vulnerable: |
RealNetworks RealPlayer SP 1.1.4 RealNetworks RealPlayer SP 1.0.5 RealNetworks RealPlayer SP 1.0.2 RealNetworks RealPlayer SP 1.0.1 RealNetworks RealPlayer SP 1.0 RealNetworks RealPlayer SP 1.1.3 RealNetworks RealPlayer SP 1.1.2 RealNetworks RealPlayer SP 1.1.1 RealNetworks RealPlayer SP 1.1 RealNetworks RealPlayer Enterprise 2.1.2 RealNetworks RealPlayer Enterprise 1.7 RealNetworks RealPlayer Enterprise 1.6 RealNetworks RealPlayer Enterprise 1.5 RealNetworks RealPlayer Enterprise 1.2 RealNetworks RealPlayer Enterprise 1.1 |
| Not Vulnerable: |
RealNetworks RealPlayer SP 1.1.5 RealNetworks RealPlayer Enterprise 2.1.3 |
Discussion
Real Networks RealPlayer SP and RealPlayer Enterprise Remote Code Execution Vulnerability
Real Networks RealPlayer SP and RealPlayer Enterprise are prone to a remote code-execution vulnerability because they fail to sufficiently validate user-supplied data.
Successful exploits will allow remote attackers to execute arbitrary code within the context of the affected application. Failed attacks may cause denial-of-service conditions.
Versions prior to RealPlayer SP 1.1.5 for Windows and RealPlayer Enterprise 2.1.3 are vulnerable.
NOTE: This issue was previously discussed in BID 44144 (Real Networks RealPlayer SP and RealPlayer Enterprise Multiple Security Vulnerabilities) but has been given its own records to better document it.
Real Networks RealPlayer SP and RealPlayer Enterprise are prone to a remote code-execution vulnerability because they fail to sufficiently validate user-supplied data.
Successful exploits will allow remote attackers to execute arbitrary code within the context of the affected application. Failed attacks may cause denial-of-service conditions.
Versions prior to RealPlayer SP 1.1.5 for Windows and RealPlayer Enterprise 2.1.3 are vulnerable.
NOTE: This issue was previously discussed in BID 44144 (Real Networks RealPlayer SP and RealPlayer Enterprise Multiple Security Vulnerabilities) but has been given its own records to better document it.
Exploit / POC
Solution / Fix
Real Networks RealPlayer SP and RealPlayer Enterprise Remote Code Execution Vulnerability
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
Real Networks RealPlayer SP and RealPlayer Enterprise Remote Code Execution Vulnerability
References:
References: