Real Networks RealPlayer CVE-2011-2945 Remote Heap Buffer Overflow Vulnerability

Bugtraq ID:	49196
Class:	Boundary Condition Error
CVE:	CVE-2011-2945
Remote:	Yes
Local:	No
Published:	Aug 16 2011 12:00AM
Updated:	Aug 16 2011 12:00AM
Credit:	Omair through iDefense Labs
Vulnerable:	Real Networks RealPlayer SP 1.1.5 Real Networks RealPlayer SP 1.1.4 Real Networks RealPlayer SP 1.0.5 Real Networks RealPlayer SP 1.0.2 Real Networks RealPlayer SP 1.0.1 Real Networks RealPlayer SP 1.0 Real Networks RealPlayer SP 1.1.3 Real Networks RealPlayer SP 1.1.2 Real Networks RealPlayer SP 1.1.1 Real Networks RealPlayer SP 1.1 Real Networks RealPlayer 14.0.2 633 Real Networks RealPlayer 11.0.5 Real Networks RealPlayer 11.0.4 Real Networks RealPlayer 11.0.3 Real Networks RealPlayer 11.0.2 Real Networks RealPlayer 11.0.1 Real Networks RealPlayer 14.0.5 Real Networks RealPlayer 14.0.3 Real Networks RealPlayer 14.0.2 Real Networks RealPlayer 14.0.1.633 Real Networks RealPlayer 14.0.1.609 Real Networks RealPlayer 14.0.1 Real Networks RealPlayer 14.0.0 Real Networks RealPlayer 11.1 Real Networks RealPlayer 11.0.2.2315 Real Networks RealPlayer 11.0.2.1744
Not Vulnerable:	Real Networks RealPlayer 14.0.6

Real Networks RealPlayer CVE-2011-2945 Remote Heap Buffer Overflow Vulnerability

Real Networks RealPlayer is prone to a remote heap-based buffer-overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data.

Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition.

NOTE: This issue was previously discussed in BID 49169 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it.

Real Networks RealPlayer CVE-2011-2945 Remote Heap Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Real Networks RealPlayer CVE-2011-2945 Remote Heap Buffer Overflow Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Real Networks RealPlayer CVE-2011-2945 Remote Heap Buffer Overflow Vulnerability

References:

• RealNetworks, Inc. Releases Update to Address Security Vulnerabilities. (RealPlayer)
  
• RealPlayer Homepage (Real Networks)