RealOne Player SMIL File Heap Corruption Vulnerability

Bugtraq ID:	6227
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Unknown
Published:	Nov 22 2002 12:00AM
Updated:	Nov 22 2002 12:00AM
Credit:	Discovery of this vulnerability is credited to NGSSoftware.
Vulnerable:	RealNetworks RealPlayer 8.0 Win32 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 98 SP1 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows XP Home - Microsoft Windows XP Professional RealNetworks RealPlayer 7.0 Win32 RealNetworks RealPlayer 6.0 Win32 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 RealNetworks RealPlayer G2 RealNetworks RealOne Player 2.0 RealNetworks RealOne Player
Not Vulnerable:

RealOne Player SMIL File Heap Corruption Vulnerability

A buffer overrun has been discovered in RealPlayer/RealOne Player.

By constructing a malicious Synchronized Multimedia Integration Language (SMIL) file, it may be possible to trigger the overrun. Successful exploitation of this issue will result in heap corruption, which may allow for the execution of attacker-supplied code.

** Reports indicate that the patch for this issue supplied by Real Networks does not correct the problem.

RealOne Player SMIL File Heap Corruption Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

RealOne Player SMIL File Heap Corruption Vulnerability

Solution:
Real Networks has released a patch which addresses this issue.

** Note that reports indicate that the patch supplied by Real Networks for this issue does not rectify the problem.


RealNetworks RealOne Player

• Real Networks skinpatchr11s.rmp
  http://service.real.com/help/faq/security/07092002/skinpatchr11s.rmp

RealNetworks RealOne Player 2.0

• Real Networks skinpatchr11s.rmp
  http://service.real.com/help/faq/security/07092002/skinpatchr11s.rmp

RealOne Player SMIL File Heap Corruption Vulnerability

References:

• RealPlayer Buffer Overrun Vulnerability (Real Networks)
  
• RealPlayer security fix is faulty (The Register)