Real Networks RealPlayer Versions Prior to 15.0.0 Multiple Remote Vulnerabilities

Bugtraq ID:	50741
Class:	Unknown
CVE:	CVE-2011-4244 CVE-2011-4245 CVE-2011-4246 CVE-2011-4247 CVE-2011-4248 CVE-2011-4249 CVE-2011-4250 CVE-2011-4251 CVE-2011-4252 CVE-2011-4253 CVE-2011-4254 CVE-2011-4255 CVE-2011-4256 CVE-2011-4257 CVE-2011-4258 CVE-2011-4259 CVE-2011-4260 CVE-2011-4261 CVE-2011-4262
Remote:	Yes
Local:	No
Published:	Nov 21 2011 12:00AM
Updated:	Jun 17 2012 12:00AM
Credit:	Omair throug iDefense Labs, Andrzej Dyjak through iDefense Labs, Damian Put through Zero Day Initiative, Luigi Auriemma through Zero Day Initiative and Alexander Gavrun through Zero Day Initiative.
Vulnerable:	Real Networks RealPlayer SP 1.1.5 Real Networks RealPlayer SP 1.1.4 Real Networks RealPlayer SP 1.0.5 Real Networks RealPlayer SP 1.0.2 Real Networks RealPlayer SP 1.0.1 Real Networks RealPlayer SP 1.0 Real Networks RealPlayer SP 1.1.3 Real Networks RealPlayer SP 1.1.2 Real Networks RealPlayer SP 1.1.1 Real Networks RealPlayer SP 1.1 Real Networks RealPlayer SP 0 Real Networks RealPlayer Enterprise 2.1.3 Real Networks RealPlayer Enterprise 2.1.2 Real Networks RealPlayer Enterprise 1.7 Real Networks RealPlayer Enterprise 1.6 Real Networks RealPlayer Enterprise 1.5 Real Networks RealPlayer Enterprise 1.2 Real Networks RealPlayer Enterprise 1.1 Real Networks RealPlayer Enterprise 2.1.6 Real Networks RealPlayer Enterprise 2.1.5 Real Networks RealPlayer Enterprise 2.1.4 Real Networks RealPlayer Enterprise 2.0 Real Networks RealPlayer Enterprise Real Networks RealPlayer 11 Beta 6.0.14 .550 Real Networks RealPlayer 14.0.7 Real Networks RealPlayer 14.0.2 633 Real Networks RealPlayer 11.0.5 Real Networks RealPlayer 11.0.4 Real Networks RealPlayer 11.0.3 Real Networks RealPlayer 11.0.2 Real Networks RealPlayer 11.0.1 Real Networks RealPlayer 14.0.6 Real Networks RealPlayer 14.0.5 Real Networks RealPlayer 14.0.3 Real Networks RealPlayer 14.0.2 Real Networks RealPlayer 14.0.1.633 Real Networks RealPlayer 14.0.1.609 Real Networks RealPlayer 14.0.1 Real Networks RealPlayer 14.0.0 Real Networks RealPlayer 11.1 Real Networks RealPlayer 11.0.2.2315 Real Networks RealPlayer 11.0.2.1744 Real Networks RealPlayer 11 Beta Real Networks RealPlayer 11 Real Networks Mac RealPlayer 12.0.0.1701
Not Vulnerable:	Real Networks RealPlayer Enterprise 2.1.8 Real Networks RealPlayer 15.0 Real Networks Mac RealPlayer 12.0.0.1703

Real Networks RealPlayer Versions Prior to 15.0.0 Multiple Remote Vulnerabilities

Real Networks RealPlayer is prone to multiple security vulnerabilities.

Real Networks released an advisory regarding 19 security vulnerabilities in RealPlayer.

Successful exploits will allow remote attackers to execute arbitrary code within the context of the affected application. Other attacks may also be possible.

The following versions are affected:

RealPlayer 11.0 to 11.1
RealPlayer SP 1.0 to 1.1.5
RealPlayer 14.0.0 to 14.0.7
Mac RealPlayer 12.0.0.1701

Real Networks RealPlayer Versions Prior to 15.0.0 Multiple Remote Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Real Networks RealPlayer Versions Prior to 15.0.0 Multiple Remote Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.

Real Networks RealPlayer Versions Prior to 15.0.0 Multiple Remote Vulnerabilities

References:

• RealNetworks, Inc. Releases Update to Address Security Vulnerabilities. (Real Networks)
  
• RealPlayer Enterprise Multiple Vulnerabilities (Real Networks)
  
• RealPlayer Homepage (Real Networks)
  
• ZDI-11-331 : RealNetwork RealPlayer MPG Width Integer Underflow Remote Code Exe (ZDI Disclosures )
  
• ZDI-11-332 : RealNetworks RealPlayer Malformed AAC File Parsing Remote Code Exe (ZDI Disclosures )
  
• ZDI-11-333 : RealNetworks RealPlayer ATRC Code Data Parsing Remote Code Executi (ZDI Disclosures )
  
• ZDI-11-336 : RealNetworks RealPlayer Invalid Codec Name Remote Code Execution V (ZDI Disclosures )
  
• RealNetwork RealPlayer MPG Width Integer Underflow Remote Code Execution Vulnera (Zero Day Initiative)
  
• RealNetworks RealPlayer AAC Codec Memory Corruption Vulnerability (iDefense)
  
• RealNetworks RealPlayer dmp4 esds Width Remote Code Execution Vulnerability (HP)
  
• RealNetworks RealPlayer QCELP Stream Parsing Remote Code Execution Vulnerability (Zero Day Initiative)
  
• RealNetworks RealPlayer RealVideo Renderer Memory Corruption Vulnerability (iDefense)
  
• RealNetworks RealPlayer RTSP SETUP Request Remote Code Execution Vulnerability (TippingPoint Zero Day Initiative)
  
• RealNetworks RealPlayer RVRENDER Heap Buffer Overflow Vulnerability (iDefense)
  
• ZDI-11-332 RealNetworks RealPlayer Malformed AAC File Parsing Remote Code Execut (Zero Day Initiative)
  
• ZDI-11-333 RealNetworks RealPlayer ATRC Code Data Parsing Remote Code Execution (Zero Day Initiative)
  
• ZDI-11-334 : RealNetworks RealPlayer genr Sample Size Parsing Remote Code Execu (ZDI Disclosures )
  
• ZDI-11-334 RealNetworks RealPlayer genr Sample Size Parsing Remote Code Executio (Zero Day Initiative)
  
• ZDI-11-335 RealNetworks RealPlayer RV10 Sample Height Parsing Remote Code Execut (Zero Day Initiative)
  
• ZDI-11-336 RealNetworks RealPlayer Invalid Codec Name Remote Code Execution Vuln (Zero Day Initiative)
  
• ZDI-11-337 : RealNetworks RealPlayer RV30 Uninitialized Index Value Remote Code (ZDI Disclosures )
  
• ZDI-11-337 RealNetworks RealPlayer RV30 Uninitialized Index Value Remote Code Ex (Zero Day Initiative)
  
• ZDI-11-338 RealNetworks RealPlayer IVR MLTI Chunk Length Parsing Remote Code Exe (Zero Day Initiative)
  
• ZDI-11-343 RealNetworks RealPlayer mp4arender esds channel count Remote Code Exe (Zero Day Initiative)
  
• ZDI-11-344 RealNetworks RealPlayer RV20 Decoding Remote Code Execution Vulnerabi (Zero Day Initiative)
  
• ZDI-12-046 RealNetworks RealPlayer Cook Codec Channel Parsing Remote Code Execut (Zero Day Initiative)
  
• ZDI-12-050: RealNetworks RealPlayer mp4fformat rdrf Remote Code Execution Vulner (Zero Day Initiative)
  
• ZDI-12-053 RealNetworks RealPlayer RV30 Sample Arbitrary Index Remote Code Execu (Zero Day Initiative)
  
• ZDI-12-087 : RealNetworks RealPlayer raac.dll stsz Remote Code Execution Vulnera (HP)