Real Networks Cook Codec Memory Access Vulnerability

Bugtraq ID:	45463
Class:	Design Error
CVE:	CVE-2010-2579
Remote:	Yes
Local:	No
Published:	Dec 10 2010 12:00AM
Updated:	Dec 20 2010 03:24PM
Credit:	Alin Rad Pop, Secunia Research
Vulnerable:	Real Networks RealPlayer SP 1.1.4 Real Networks RealPlayer SP 1.0.5 Real Networks RealPlayer SP 1.0.2 Real Networks RealPlayer SP 1.0.1 Real Networks RealPlayer SP 1.0 Real Networks RealPlayer SP 1.1.3 Real Networks RealPlayer SP 1.1.2 Real Networks RealPlayer SP 1.1.1 Real Networks RealPlayer SP 1.1 Real Networks RealPlayer for Mac 11.1 Real Networks RealPlayer for Mac 11.0 Real Networks RealPlayer for Linux 11.0.2.1744 Real Networks RealPlayer Enterprise 2.1.2 Real Networks RealPlayer Enterprise 1.7 Real Networks RealPlayer Enterprise 1.6 Real Networks RealPlayer Enterprise 1.5 Real Networks RealPlayer Enterprise 1.2 Real Networks RealPlayer Enterprise 1.1 Real Networks RealPlayer Enterprise Real Networks RealPlayer 10 for Linux 10.1 .3114 Real Networks RealPlayer 10 for Linux 10.0.9 Real Networks RealPlayer 10 for Linux 10.0.8 Real Networks RealPlayer 10 for Linux 10.0.7 Real Networks RealPlayer 10 for Linux 10.0.6 Real Networks RealPlayer 10 for Linux 10.0.5 Real Networks RealPlayer 10 for Linux 10.0.4 Real Networks RealPlayer 10 for Linux 10.0.3 Real Networks RealPlayer 10 for Linux 10.0.2 Real Networks RealPlayer 10 for Linux 10.0.1 Real Networks RealPlayer 10 for Linux
Not Vulnerable:	Real Networks RealPlayer SP 1.1.5 Real Networks RealPlayer for Mac 12.0.0.1548 Real Networks RealPlayer for Linux 11.0.2.2315 Real Networks RealPlayer Enterprise 2.1.3 Real Networks RealPlayer Enterprise 2.1.4 Real Networks RealPlayer 14.0.1

Real Networks Cook Codec Memory Access Vulnerability

Real Networks RealPlayer is prone to a memory-access vulnerability.

An attacker can exploit this issue to read and write to arbitrary locations in memory. Successful exploits may allow attackers to gain access to sensitive information, cause a denial-of-service condition or memory corruption.

The following versions are affected:

RealPlayer SP 1.1.4 and prior
RealPlayer Enterprise 2.1.2 and prior
Mac RealPlayer 11.1 and prior
Linux RealPlayer 11.0.2.1744 and prior

NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it.

Real Networks Cook Codec Memory Access Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Real Networks Cook Codec Memory Access Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Real Networks Cook Codec Memory Access Vulnerability

References:

• Advanced notification: RealPlayer security update coming (Real Networks)
  
• Real Networks Homepage (Real Networks)
  
• RealNetworks Vulnerability Remediation Improvements (DVLabs)
  
• Secunia Research: RealPlayer 'cook' Arbitrary Free Vulnerability (Secunia Research )
  
• Dec 10, 2010: RealNetworks, Inc. Releases Update to Address Security Vulnerabili (Real Networks)