RealPlayer ActiveX Control CDDA URI Uninitialized Pointer Vulnerability
BID:44450
Info
RealPlayer ActiveX Control CDDA URI Uninitialized Pointer Vulnerability
| Bugtraq ID: | 44450 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2010-3747 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 15 2010 12:00AM |
| Updated: | Mar 18 2011 07:57AM |
| Credit: | An anonymous researcher working with TippingPoint's Zero Day Initiative |
| Vulnerable: |
Real Networks RealPlayer SP 1.1.4 Real Networks RealPlayer SP 1.0.2 Real Networks RealPlayer SP 1.0.1 Real Networks RealPlayer SP 1.0 Real Networks RealPlayer SP 1.1.3 Real Networks RealPlayer SP 1.1.2 Real Networks RealPlayer SP 1.1.1 Real Networks RealPlayer SP 1.1 Real Networks RealPlayer Enterprise 2.1.2 Real Networks RealPlayer 11.0.5 Real Networks RealPlayer 11.0.2 Real Networks RealPlayer 11.0.1 Real Networks RealPlayer 11.1 Real Networks RealPlayer 11 |
| Not Vulnerable: |
Real Networks RealPlayer SP 1.1.5 |
Discussion
RealPlayer ActiveX Control CDDA URI Uninitialized Pointer Vulnerability
Real Networks RealPlayer SP and Enterprise are prone to a remote code-execution vulnerability.
A remote attacker may exploit this issue by enticing victims into opening a malicious HTML document.
Exploiting this issue allows the attacker to execute arbitrary code in the context of applications using the affected ActiveX control. Failed attempts will likely result in denial-of-service conditions.
NOTE: This issue was previously discussed in BID 44144 (Real Networks RealPlayer SP and RealPlayer Enterprise Multiple Security Vulnerabilities) but has been given its own records to better document it.
Real Networks RealPlayer SP and Enterprise are prone to a remote code-execution vulnerability.
A remote attacker may exploit this issue by enticing victims into opening a malicious HTML document.
Exploiting this issue allows the attacker to execute arbitrary code in the context of applications using the affected ActiveX control. Failed attempts will likely result in denial-of-service conditions.
NOTE: This issue was previously discussed in BID 44144 (Real Networks RealPlayer SP and RealPlayer Enterprise Multiple Security Vulnerabilities) but has been given its own records to better document it.
Exploit / POC
RealPlayer ActiveX Control CDDA URI Uninitialized Pointer Vulnerability
The following exploit is available:
The following exploit is available:
Solution / Fix
RealPlayer ActiveX Control CDDA URI Uninitialized Pointer Vulnerability
Solution:
The vendor released an update to address this issue. Please see the references for more information.
Solution:
The vendor released an update to address this issue. Please see the references for more information.
References
RealPlayer ActiveX Control CDDA URI Uninitialized Pointer Vulnerability
References:
References:
- Microsoft Knowledge Base Article 240797 (Microsoft)
- RealNetworks, Inc. Releases Update to Address Security Vulnerabilities. (Real Networks)
- RealPlayer Homepage (Real Networks )
- ZDI-10-210 RealNetworks RealPlayer ActiveX Control CDDA URI Uninitialized Pointe (ZDI)