RealPlayer '.3gp' File Processing Memory Corruption Vulnerability

Bugtraq ID:	67434
Class:	Unknown
CVE:	CVE-2014-3444
Remote:	Yes
Local:	No
Published:	May 16 2014 12:00AM
Updated:	May 16 2014 12:00AM
Credit:	Aryan Bayaninejad
Vulnerable:
Not Vulnerable:

RealPlayer '.3gp' File Processing Memory Corruption Vulnerability

RealPlayer is prone to a memory-corruption vulnerability.

An attacker can leverage this issue to crash the affected application, causing a denial-of-service condition. Due to the nature of this issue, arbitrary code execution may be possible but this has not been confirmed.

Realplayer 16.0.3.51 is vulnerable; other versions may also be affected.

RealPlayer '.3gp' File Processing Memory Corruption Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to open a specially crafted file with the affected application.

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/67434.py

RealPlayer '.3gp' File Processing Memory Corruption Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RealPlayer '.3gp' File Processing Memory Corruption Vulnerability

References:

• RealPlayer Homepage (Real Networks)