RealOne Player SMIL File Script Execution Variant Vulnerability
BID:9378
Info
RealOne Player SMIL File Script Execution Variant Vulnerability
| Bugtraq ID: | 9378 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 07 2004 12:00AM |
| Updated: | Jan 07 2004 12:00AM |
| Credit: | Discovery is credited to Arman Nayyeri. |
| Vulnerable: |
RealNetworks RealPlayer 8.0 Win32 RealNetworks RealOne Player Gold for Windows 6.0.10 .505 RealNetworks RealOne Player 6.0.11 .868 RealNetworks RealOne Player 6.0.11 .853 RealNetworks RealOne Player 6.0.11 .841 RealNetworks RealOne Player 6.0.11 .830 RealNetworks RealOne Player 6.0.11 .818 RealNetworks RealOne Player 2.0 RealNetworks RealOne Player 1.0 RealNetworks RealOne Enterprise Desktop 6.0.11 .774 RealNetworks RealOne Desktop Manager |
| Not Vulnerable: | |
Discussion
RealOne Player SMIL File Script Execution Variant Vulnerability
A vulnerability has been reported in RealOne Player. Script embedded in SMIL presentations may be executed in the context of a domain that is specified by an attacker. In particular, if a URI is opened from within a SMIL file, embedded script code may access the properties of the URI's domain.
This could allow for theft of cookie-based authentication credentials, but more seriously, could also cause embedded script code to be executed in the context of the My Computer Zone.
This issue is a variant of the vulnerability described in BID 8453. The syntax used to embed script code is different than the previous vulnerability, and this new issue affects fixed versions of the player.
As with the previous issue, there is also a likelihood that malicious script code could be embedded into other file types that are handled by the player.
A vulnerability has been reported in RealOne Player. Script embedded in SMIL presentations may be executed in the context of a domain that is specified by an attacker. In particular, if a URI is opened from within a SMIL file, embedded script code may access the properties of the URI's domain.
This could allow for theft of cookie-based authentication credentials, but more seriously, could also cause embedded script code to be executed in the context of the My Computer Zone.
This issue is a variant of the vulnerability described in BID 8453. The syntax used to embed script code is different than the previous vulnerability, and this new issue affects fixed versions of the player.
As with the previous issue, there is also a likelihood that malicious script code could be embedded into other file types that are handled by the player.
Exploit / POC
RealOne Player SMIL File Script Execution Variant Vulnerability
A proof-of-concept that demonstrates how to exploit this issue to install an executable is available at the following location:
http://www.freewebs.com/arman2/arealexploit.htm
A proof-of-concept that demonstrates how to exploit this issue to install an executable is available at the following location:
http://www.freewebs.com/arman2/arealexploit.htm
Solution / Fix
RealOne Player SMIL File Script Execution Variant Vulnerability
Solution:
RealSecurity has released an advisory dealing with this issue. The following text, describing how to apply the patch to address the issue with the vulnerable software, has been taken verbatim from the advisory:
Windows Players:
RealOne Player, RealOne Player v2 (localized languages) and RealPlayer 10 Beta customers please use the following steps to update your Player:
1. In the Tools menu select Check for Update.
2. Select the box next to the "RealPlayer 10" (English) or "RealOne Player" (localized) component.
3. Click the Install button to download and install the update.
RealPlayer 8 (version 6.0.9.584):
1. Go to the Help menu.
2. Select "Check for Update".
3. Select the box next to the "RealPlayer 10" (English) or "RealOne Player" (localized) component.
4. Click the Install button to download and install the update.
Solution:
RealSecurity has released an advisory dealing with this issue. The following text, describing how to apply the patch to address the issue with the vulnerable software, has been taken verbatim from the advisory:
Windows Players:
RealOne Player, RealOne Player v2 (localized languages) and RealPlayer 10 Beta customers please use the following steps to update your Player:
1. In the Tools menu select Check for Update.
2. Select the box next to the "RealPlayer 10" (English) or "RealOne Player" (localized) component.
3. Click the Install button to download and install the update.
RealPlayer 8 (version 6.0.9.584):
1. Go to the Help menu.
2. Select "Check for Update".
3. Select the box next to the "RealPlayer 10" (English) or "RealOne Player" (localized) component.
4. Click the Install button to download and install the update.
References
RealOne Player SMIL File Script Execution Variant Vulnerability
References:
References:
- RealNetworks, Inc. Releases Update to Address Security Vulnerabilities. (RealSecurity)
- RealPlayer Homepage (Real Networks)
- RealNetworks fails to address Cross-Site Scripting in RealOne Player (Arman Nayyeri