Real Networks RealJukebox/RealOne Player Gold Skinfile Buffer Overflow

Bugtraq ID:	5217
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 12 2002 12:00AM
Updated:	Jul 12 2002 12:00AM
Credit:	Discovery of this issue is credited to UNYUN <[email protected]>.
Vulnerable:	RealNetworks RealOne Player Gold for Windows 6.0.10 .505 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional RealNetworks RealJukebox 2 Plus for Windows 1.0.2 .379 RealNetworks RealJukebox 2 Plus for Windows 1.0.2 .340 RealNetworks RealJukebox 2 for Windows 1.0.2 .379 RealNetworks RealJukebox 2 for Windows 1.0.2 .340
Not Vulnerable:

Real Networks RealJukebox/RealOne Player Gold Skinfile Buffer Overflow

Real Software has announced a vulnerability in RealJukebox2 and Real Player Gold.

A buffer overflow condition exists due to insufficient bounds checking of fields in skinfiles. There is an unchecked buffer for the "CONTROLnImage" field of the "skin.ini" file. By supplying an overly long filename as a value for this field, it is possible to overwrite stack variables. An attacker may exploit this condition to overwrite the return address with a pointer to embedded attacker-supplied instructions.

To exploit this issue the attacker must transmit the maliciously constructed skinfile to a victim of the attack. This may be done via a webpage or HTML e-mail. Exploitation of this issue may result in execution of attacker-supplied instructions with the privileges of the user opening the malicious skinfile.

Real Networks RealJukebox/RealOne Player Gold Skinfile Buffer Overflow

Solution:
Fixes are available:


RealNetworks RealJukebox 2 for Windows 1.0.2 .340

• Real Networks skinpfree1.rmp
  http://www.service.real.com/help/faq/security/07092002/skinpfree1.rmp

RealNetworks RealJukebox 2 for Windows 1.0.2 .379

• Real Networks skinpfree2.rmp
  http://www.service.real.com/help/faq/security/07092002/skinpfree2.rmp

RealNetworks RealJukebox 2 Plus for Windows 1.0.2 .379

• Real Networks skinpplus2.rmp
  http://www.service.real.com/help/faq/security/07092002/skinpplus2.rmp

RealNetworks RealJukebox 2 Plus for Windows 1.0.2 .340

• Real Networks skinpplus1.rmp
  http://www.service.real.com/help/faq/security/07092002/skinpplus1.rmp

RealNetworks RealOne Player Gold for Windows 6.0.10 .505

• Real Networks skinpatchr11s.rmp
  http://www.service.real.com/help/faq/security/07092002/skinpatchr11s.r mp