RealOne Player Temporary File Default Browser Script Execution Vulnerability

Bugtraq ID:	8839
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 15 2003 12:00AM
Updated:	Oct 15 2003 12:00AM
Credit:	Vulnerability disclosed by RealNetworks.
Vulnerable:	RealNetworks RealOne Player Gold for Windows 6.0.10 .505 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home - Microsoft Windows XP Professional RealNetworks RealOne Player 6.0.11 .853 RealNetworks RealOne Player 6.0.11 .841 RealNetworks RealOne Player 6.0.11 .830 RealNetworks RealOne Player 6.0.11 .818 RealNetworks RealOne Player 2.0 RealNetworks RealOne Player RealNetworks RealOne Enterprise Desktop 6.0.11 .774 RealNetworks RealOne Desktop Manager
Not Vulnerable:

RealOne Player Temporary File Default Browser Script Execution Vulnerability

It has been reported that RealOne Player is vulnerable to an issue in the handling of temporary files. Because of this, an attacker may be able to perform unauthorized actions in a user's web browser.

RealOne Player Temporary File Default Browser Script Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

RealOne Player Temporary File Default Browser Script Execution Vulnerability

Solution:
Real Networks has released patches to address this issue. Please see the Real Networks announcement for details on obtaining and applying updates for RealOne Enterprise Product.

RealOne Player Temporary File Default Browser Script Execution Vulnerability

References:

• 10-03 RealNetworks Releases Security Update to Address RealOne Player Security (RealNetworks)