Real Networks RealPlayer '.AVI' File Parsing (CVE-2010-4393) Buffer Overflow Vulnerability

Bugtraq ID:	46047
Class:	Boundary Condition Error
CVE:	CVE-2010-4393
Remote:	Yes
Local:	No
Published:	Jan 27 2011 12:00AM
Updated:	Jan 27 2011 12:00AM
Credit:	Juan Pablo Lopez Yacubian
Vulnerable:	RealNetworks RealPlayer SP 1.1.5 RealNetworks RealPlayer SP 1.1.4 RealNetworks RealPlayer SP 1.0.5 RealNetworks RealPlayer SP 1.0.2 RealNetworks RealPlayer SP 1.0.1 RealNetworks RealPlayer SP 1.0 RealNetworks RealPlayer SP 1.1.3 RealNetworks RealPlayer SP 1.1.2 RealNetworks RealPlayer SP 1.1.1 RealNetworks RealPlayer SP 1.1 RealNetworks RealPlayer 11.0.5 RealNetworks RealPlayer 11.0.4 RealNetworks RealPlayer 11.0.3 RealNetworks RealPlayer 11.0.2 RealNetworks RealPlayer 11.0.1 RealNetworks RealPlayer 14.0.1 RealNetworks RealPlayer 14.0.0 RealNetworks RealPlayer 11.1 RealNetworks RealPlayer 11.0.2.2315 RealNetworks RealPlayer 11.0.2.1744 RealNetworks RealPlayer 11
Not Vulnerable:	RealNetworks RealPlayer Enterprise 2.1.3 RealNetworks RealPlayer Enterprise 2.1.2 RealNetworks RealPlayer Enterprise 2.1.4 RealNetworks RealPlayer 14.0.2

Real Networks RealPlayer '.AVI' File Parsing (CVE-2010-4393) Buffer Overflow Vulnerability

Real Networks RealPlayer is prone to a buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition.

This issue affects RealPlayer 11.0 to 11.1, SP 1.0 to 1.1.5, and 14.0.0 to 14.0.1.

Real Networks RealPlayer '.AVI' File Parsing (CVE-2010-4393) Buffer Overflow Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.