Real Networks RealPlayer RMX File (CVE-2010-4391) Heap Overflow Vulnerability
BID:45451
Info
Real Networks RealPlayer RMX File (CVE-2010-4391) Heap Overflow Vulnerability
| Bugtraq ID: | 45451 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2010-4391 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 10 2010 12:00AM |
| Updated: | Dec 10 2010 12:00AM |
| Credit: | Sebastian Apelt |
| Vulnerable: |
RealNetworks RealPlayer SP 1.1.5 RealNetworks RealPlayer SP 1.1.4 RealNetworks RealPlayer SP 1.0.5 RealNetworks RealPlayer SP 1.0.2 RealNetworks RealPlayer SP 1.0.1 RealNetworks RealPlayer SP 1.0 RealNetworks RealPlayer SP 1.1.3 RealNetworks RealPlayer SP 1.1.2 RealNetworks RealPlayer SP 1.1.1 RealNetworks RealPlayer SP 1.1 RealNetworks RealPlayer Enterprise 2.1.3 RealNetworks RealPlayer Enterprise 2.1.2 RealNetworks RealPlayer 11 Beta 6.0.14 .550 RealNetworks RealPlayer 11.0.5 RealNetworks RealPlayer 11.0.4 RealNetworks RealPlayer 11.0.3 RealNetworks RealPlayer 11.0.2 RealNetworks RealPlayer 11.0.1 RealNetworks RealPlayer 11.1 RealNetworks RealPlayer 11 Beta RealNetworks RealPlayer 11 |
| Not Vulnerable: |
RealNetworks RealPlayer Enterprise 2.1.4 RealNetworks RealPlayer 14.0.1 |
Discussion
Real Networks RealPlayer RMX File (CVE-2010-4391) Heap Overflow Vulnerability
Real Networks RealPlayer is prone to a heap-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data.
Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition.
This issue affects Windows RealPlayer SP 1.1.5 and prior and RealPlayer Enterprise 2.1.3 and prior.
NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it.
Real Networks RealPlayer is prone to a heap-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data.
Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition.
This issue affects Windows RealPlayer SP 1.1.5 and prior and RealPlayer Enterprise 2.1.3 and prior.
NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it.
References
Real Networks RealPlayer RMX File (CVE-2010-4391) Heap Overflow Vulnerability
References:
References:
- Advanced notification: RealPlayer security update coming (Real Networks)
- RealNetworks Vulnerability Remediation Improvements (DVLabs)
- RealPlayer Homepage (Real Networks)
- Dec 10, 2010: RealNetworks, Inc. Releases Update to Address Security Vulnerabili (Real Networks)
- ZDI-10-281: RealNetworks RealPlayer RMX Header Remote Code Execution Vulnerabili (ZDI Disclosures