Real Networks RealPlayer Real Audio Audio Codec Heap Overflow Vulnerability
BID:45412
Info
Real Networks RealPlayer Real Audio Audio Codec Heap Overflow Vulnerability
| Bugtraq ID: | 45412 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2010-4377 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 10 2010 12:00AM |
| Updated: | Dec 10 2010 12:00AM |
| Credit: | anonymous |
| Vulnerable: |
RealNetworks RealPlayer SP 1.1.5 RealNetworks RealPlayer SP 1.1.4 RealNetworks RealPlayer SP 1.0.5 RealNetworks RealPlayer SP 1.0.2 RealNetworks RealPlayer SP 1.0.1 RealNetworks RealPlayer SP 1.0 RealNetworks RealPlayer SP 1.1.3 RealNetworks RealPlayer SP 1.1.2 RealNetworks RealPlayer SP 1.1.1 RealNetworks RealPlayer SP 1.1 RealNetworks RealPlayer for Mac 11.1 RealNetworks RealPlayer for Mac 11.0 RealNetworks RealPlayer for Linux 11.0.2.1744 RealNetworks RealPlayer 11 Beta 6.0.14 .550 RealNetworks RealPlayer 10 for Mac OS 10.0 .0.331 RealNetworks RealPlayer 10 for Mac OS 10.0.0.503 RealNetworks RealPlayer 10 for Mac OS 10.0.0.481 RealNetworks RealPlayer 10 for Mac OS 10.0.0.412 RealNetworks RealPlayer 10 for Mac OS 10.0.0.396 RealNetworks RealPlayer 10 for Mac OS 10.0.0.352 RealNetworks RealPlayer 10 for Mac OS 10.0.0.325 RealNetworks RealPlayer 10 for Mac OS 10.0.0.305 RealNetworks RealPlayer 10 for Mac OS RealNetworks RealPlayer 10 for Linux 10.1 .3114 RealNetworks RealPlayer 10 for Linux 10.0.9 RealNetworks RealPlayer 10 for Linux 10.0.8 RealNetworks RealPlayer 10 for Linux 10.0.7 RealNetworks RealPlayer 10 for Linux 10.0.6 RealNetworks RealPlayer 10 for Linux 10.0.5 RealNetworks RealPlayer 10 for Linux 10.0.4 RealNetworks RealPlayer 10 for Linux 10.0.3 RealNetworks RealPlayer 10 for Linux 10.0.2 RealNetworks RealPlayer 10 for Linux 10.0.1 RealNetworks RealPlayer 10 for Linux RealNetworks RealPlayer 11.0.5 RealNetworks RealPlayer 11.0.4 RealNetworks RealPlayer 11.0.3 RealNetworks RealPlayer 11.0.2 RealNetworks RealPlayer 11.0.1 RealNetworks RealPlayer 11.1 RealNetworks RealPlayer 11 Beta RealNetworks RealPlayer 11 |
| Not Vulnerable: |
RealNetworks RealPlayer for Mac 12.0.0.1548 RealNetworks RealPlayer for Linux 11.0.2.2315 RealNetworks RealPlayer 14.0.1 |
Discussion
Real Networks RealPlayer Real Audio Audio Codec Heap Overflow Vulnerability
Real Networks RealPlayer is prone to a heap overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data.
Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition.
This issue affects Windows RealPlayer SP 1.1.5 and prior, Mac RealPlayer 12.0.0.1444 and prior, Linux RealPlayer 11.0.2.1744 and prior.
NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it.
Real Networks RealPlayer is prone to a heap overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data.
Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition.
This issue affects Windows RealPlayer SP 1.1.5 and prior, Mac RealPlayer 12.0.0.1444 and prior, Linux RealPlayer 11.0.2.1744 and prior.
NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it.
Exploit / POC
Real Networks RealPlayer Real Audio Audio Codec Heap Overflow Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Real Networks RealPlayer Real Audio Audio Codec Heap Overflow Vulnerability
References:
References:
- Advanced notification: RealPlayer security update coming (Real Networks)
- RealNetworks Vulnerability Remediation Improvements (DVLabs)
- RealPlayer Homepage (Real Networks)
- Dec 10, 2010: RealNetworks, Inc. Releases Update to Address Security Vulnerabili (Real Networks)
- ZDI-10-272: RealNetworks RealPlayer Cook Audio Codec Parsing Remote Code Executi (ZDI Disclosures