Search criteria
533 vulnerabilities found for realplayer by realnetworks
VAR-201001-0746
Vulnerability from variot - Updated: 2023-12-18 12:22Stack-based buffer overflow in protocol/rtsp/rtspclnt.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.x; RealPlayer SP 1.0.0 and 1.0.1; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, 11.0, and 11.0.1; Linux RealPlayer 10, 11.0.0, and 11.0.1; and Helix Player 10.x, 11.0.0, and 11.0.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an ASM RuleBook with a large number of rules, related to an "array overflow.". Realnetworks RealPlayer Is ASM RuleBook There is a vulnerability in the processing of.Skillfully crafted by a third party ASM RuleBook Can cause effects related to array overflow. A remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Successful exploits will allow the attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. The following are vulnerable: RealPlayer SP 1.0.0 through 1.0.1 RealPlayer 11 11.0.0 through 11.0.5 RealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741 RealPlayer 10 and 10.1 Helix Player 11.0.0 through 11.0.2. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. ----------------------------------------------------------------------
Secunia integrated with Microsoft WSUS http://secunia.com/blog/71/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38218
VERIFY ADVISORY: http://secunia.com/advisories/38218/
DESCRIPTION: Some vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a vulnerable system.
2) An unspecified error when processing GIF images can be exploited to cause a heap-based buffer overflow.
3) A vulnerability is caused due to an unspecified error related to HTTP chunk encoding.
4) An unspecified error within the RealPlayer SIPR codec can be exploited to cause a heap-based buffer overflow.
5) An unspecified error when processing compressed GIF images can be exploited to cause a heap-based buffer overflow.
6) An unspecified error within the RealPlayer SMIL parsing can be exploited to cause a heap-based buffer overflow.
7) An unspecified error within the RealPlayer skin parsing can be exploited to cause a stack-based buffer overflow.
9) An unspecified boundary error related to RealPlayer RTSP "set_parameter" can be exploited to cause a buffer overflow.
10) Two vulnerabilities are caused due to errors within the processing of Internet Video Recording (IVR) files. Please see the vendor's advisory for details. http://service.real.com/realplayer/security/01192010_player/en/
PROVIDED AND/OR DISCOVERED BY: The vendor credits: * Evgeny Legerov * anonymous persons working with iDEFENSE Labs * John Rambo and anonymous researchers working with TippingPoint's Zero Day Initiative
ORIGINAL ADVISORY: http://service.real.com/realplayer/security/01192010_player/en/
OTHER REFERENCES: SA33810: http://secunia.com/advisories/33810/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
.
For more information: SA38218
SOLUTION: Updated packages are available via Red Hat Network
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201001-0746",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "10.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "*"
},
{
"model": "solaris",
"scope": "eq",
"trust": 0.8,
"vendor": "sun microsystems",
"version": "10"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "(enterprise)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10.5"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.1"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (es)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.0"
},
{
"model": "solaris 10 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "solaris 10 sparc",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1741"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1698"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1675"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1663"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1483"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1348"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1235"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1069"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1059"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1056"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1053"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1040"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
}
],
"sources": [
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001053"
},
{
"db": "NVD",
"id": "CVE-2009-4247"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-250"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_enterprise:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4247"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Evgeny Legerov, anonymous researchers working with iDEFENSE Labs, John Rambo, Peter Vreugdenhil working with TippingPoint\u0027s Zero Day Initiative, and anonymous researchers working with TippingPoint\u0027s Zero Day Initiative",
"sources": [
{
"db": "BID",
"id": "37880"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-250"
}
],
"trust": 0.9
},
"cve": "CVE-2009-4247",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2009-4247",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-41693",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2009-4247",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201001-250",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-41693",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41693"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001053"
},
{
"db": "NVD",
"id": "CVE-2009-4247"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-250"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack-based buffer overflow in protocol/rtsp/rtspclnt.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.x; RealPlayer SP 1.0.0 and 1.0.1; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, 11.0, and 11.0.1; Linux RealPlayer 10, 11.0.0, and 11.0.1; and Helix Player 10.x, 11.0.0, and 11.0.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an ASM RuleBook with a large number of rules, related to an \"array overflow.\". Realnetworks RealPlayer Is ASM RuleBook There is a vulnerability in the processing of.Skillfully crafted by a third party ASM RuleBook Can cause effects related to array overflow. \nA remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Successful exploits will allow the attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. \nThe following are vulnerable:\nRealPlayer SP 1.0.0 through 1.0.1\nRealPlayer 11 11.0.0 through 11.0.5\nRealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741\nRealPlayer 10 and 10.1\nHelix Player 11.0.0 through 11.0.2. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. ----------------------------------------------------------------------\n\n\n\nSecunia integrated with Microsoft WSUS \nhttp://secunia.com/blog/71/\n\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38218\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/38218/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in RealPlayer, which can be\nexploited by malicious people to compromise a vulnerable system. \n\n2) An unspecified error when processing GIF images can be exploited\nto cause a heap-based buffer overflow. \n\n3) A vulnerability is caused due to an unspecified error related to\nHTTP chunk encoding. \n\n4) An unspecified error within the RealPlayer SIPR codec can be\nexploited to cause a heap-based buffer overflow. \n\n5) An unspecified error when processing compressed GIF images can be\nexploited to cause a heap-based buffer overflow. \n\n6) An unspecified error within the RealPlayer SMIL parsing can be\nexploited to cause a heap-based buffer overflow. \n\n7) An unspecified error within the RealPlayer skin parsing can be\nexploited to cause a stack-based buffer overflow. \n\n9) An unspecified boundary error related to RealPlayer RTSP\n\"set_parameter\" can be exploited to cause a buffer overflow. \n\n10) Two vulnerabilities are caused due to errors within the\nprocessing of Internet Video Recording (IVR) files. Please see the vendor\u0027s advisory for\ndetails. \nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits:\n* Evgeny Legerov\n* anonymous persons working with iDEFENSE Labs\n* John Rambo and anonymous researchers working with TippingPoint\u0027s\nZero Day Initiative\n\nORIGINAL ADVISORY:\nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nOTHER REFERENCES:\nSA33810:\nhttp://secunia.com/advisories/33810/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\nFor more information:\nSA38218\n\nSOLUTION:\nUpdated packages are available via Red Hat Network",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4247"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001053"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "VULHUB",
"id": "VHN-41693"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "BID",
"id": "37880",
"trust": 2.8
},
{
"db": "NVD",
"id": "CVE-2009-4247",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "38218",
"trust": 2.6
},
{
"db": "SECTRACK",
"id": "1023489",
"trust": 2.5
},
{
"db": "VUPEN",
"id": "ADV-2010-0178",
"trust": 2.5
},
{
"db": "XF",
"id": "55802",
"trust": 1.4
},
{
"db": "SECUNIA",
"id": "38450",
"trust": 1.2
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001053",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201001-250",
"trust": 0.7
},
{
"db": "REDHAT",
"id": "RHSA-2010:0094",
"trust": 0.6
},
{
"db": "MLIST",
"id": "[PROTOCOL-CVS] 20090828 RTSP RTSPCLNT.CPP,1.244,1.245",
"trust": 0.6
},
{
"db": "MLIST",
"id": "[HELIX-CLIENT-DEV] 20090828 CR: 249097 - SECURITY FIX - URGENT CR REQUESTED",
"trust": 0.6
},
{
"db": "ZDI",
"id": "ZDI-10-010",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-008",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-006",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-005",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-007",
"trust": 0.3
},
{
"db": "VULHUB",
"id": "VHN-41693",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "85439",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "86184",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41693"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001053"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "NVD",
"id": "CVE-2009-4247"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-250"
}
]
},
"id": "VAR-201001-0746",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-41693"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:22:43.113000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/en"
},
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/ja/"
},
{
"title": "RHSA-2010:0094",
"trust": 0.8,
"url": "http://rhn.redhat.com/errata/rhsa-2010-0094.html"
},
{
"title": "cve_2009_4247_buffer_overflow",
"trust": 0.8,
"url": "http://blogs.sun.com/security/entry/cve_2009_4247_buffer_overflow"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5474"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5473"
},
{
"title": "RealPlayerSP",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5472"
},
{
"title": "RealPlayerSPGold",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5471"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001053"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-250"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41693"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001053"
},
{
"db": "NVD",
"id": "CVE-2009-4247"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/37880"
},
{
"trust": 2.5,
"url": "http://securitytracker.com/id?1023489"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/38218"
},
{
"trust": 2.5,
"url": "http://www.vupen.com/english/advisories/2010/0178"
},
{
"trust": 2.1,
"url": "http://service.real.com/realplayer/security/01192010_player/en/"
},
{
"trust": 1.7,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=561338"
},
{
"trust": 1.7,
"url": "https://helixcommunity.org/viewcvs/protocol/rtsp/rtspclnt.cpp?view=log#rev1.245"
},
{
"trust": 1.7,
"url": "http://lists.helixcommunity.org/pipermail/helix-client-dev/2009-august/008092.html"
},
{
"trust": 1.7,
"url": "http://lists.helixcommunity.org/pipermail/protocol-cvs/2009-august/001943.html"
},
{
"trust": 1.7,
"url": "http://www.redhat.com/support/errata/rhsa-2010-0094.html"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/55802"
},
{
"trust": 1.1,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a10677"
},
{
"trust": 1.1,
"url": "http://secunia.com/advisories/38450"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55802"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4247"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-4247"
},
{
"trust": 0.3,
"url": "http://blogs.sun.com/security/entry/cve_2009_4247_buffer_overflow"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=839"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=837"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=838"
},
{
"trust": 0.3,
"url": "http://www.realnetworks.com/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-005/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-006/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-007/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-008/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-010/"
},
{
"trust": 0.3,
"url": "/archive/1/509286"
},
{
"trust": 0.3,
"url": "/archive/1/509293"
},
{
"trust": 0.3,
"url": "/archive/1/509288"
},
{
"trust": 0.3,
"url": "/archive/1/509100"
},
{
"trust": 0.3,
"url": "/archive/1/509096"
},
{
"trust": 0.3,
"url": "/archive/1/509105"
},
{
"trust": 0.3,
"url": "/archive/1/509098"
},
{
"trust": 0.3,
"url": "/archive/1/509104"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/38218/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/blog/71/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33810/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38450/"
},
{
"trust": 0.1,
"url": "http://rhn.redhat.com"
},
{
"trust": 0.1,
"url": "http://rhn.redhat.com/errata/rhsa-2010-0094.html"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41693"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001053"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "NVD",
"id": "CVE-2009-4247"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-250"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-41693"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001053"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "NVD",
"id": "CVE-2009-4247"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-250"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-01-25T00:00:00",
"db": "VULHUB",
"id": "VHN-41693"
},
{
"date": "2010-01-20T00:00:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001053"
},
{
"date": "2010-01-20T16:00:34",
"db": "PACKETSTORM",
"id": "85439"
},
{
"date": "2010-02-11T10:10:16",
"db": "PACKETSTORM",
"id": "86184"
},
{
"date": "2010-01-25T19:30:01.510000",
"db": "NVD",
"id": "CVE-2009-4247"
},
{
"date": "2010-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-250"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-19T00:00:00",
"db": "VULHUB",
"id": "VHN-41693"
},
{
"date": "2010-07-13T20:27:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-07-23T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001053"
},
{
"date": "2017-09-19T01:29:56.577000",
"db": "NVD",
"id": "CVE-2009-4247"
},
{
"date": "2011-07-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-250"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201001-250"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Realnetworks RealPlayer In ASM RuleBook Processing vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001053"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201001-250"
}
],
"trust": 0.6
}
}
VAR-201001-0739
Vulnerability from variot - Updated: 2023-12-18 12:22Stack-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows user-assisted remote attackers to execute arbitrary code via a malformed .RJS skin file that contains a web.xmb file with crafted length values. This vulnerability allows remote attackers to execute code on vulnerable installations of RealNetworks RealPlayer. User interaction is required in that a user must visit a malicious website or open a malicious file and accept a dialog to switch player skins.The specific flaw exists during parsing of malformed RealPlayer .RJS skin files. While loading a skin the application copies certain variable length fields from the extracted file named web.xmb into a statically sized buffer. By crafting these fields appropriately an attack can cause the process to overflow the buffer. This can be leveraged to execute arbitrary code with the privileges of the application. RealPlayer SP, RealPlayer, and Helix Player are prone to multiple remote vulnerabilities, including heap- and stack-based buffer-overflow issues. A remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Failed exploit attempts will result in a denial-of-service condition. The following are vulnerable: RealPlayer SP 1.0.0 through 1.0.1 RealPlayer 11 11.0.0 through 11.0.5 RealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741 RealPlayer 10 and 10.1 Helix Player 11.0.0 through 11.0.2. ----------------------------------------------------------------------
Secunia integrated with Microsoft WSUS http://secunia.com/blog/71/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38218
VERIFY ADVISORY: http://secunia.com/advisories/38218/
DESCRIPTION: Some vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a vulnerable system.
1) An unspecified error related to the RealPlayer ASM Rulebook can be exploited to cause a heap-based buffer overflow.
3) A vulnerability is caused due to an unspecified error related to HTTP chunk encoding.
5) An unspecified error when processing compressed GIF images can be exploited to cause a heap-based buffer overflow.
6) An unspecified error within the RealPlayer SMIL parsing can be exploited to cause a heap-based buffer overflow.
8) An unspecified error related to the RealPlayer ASM RuleBook can be exploited to cause an "array overflow".
9) An unspecified boundary error related to RealPlayer RTSP "set_parameter" can be exploited to cause a buffer overflow.
10) Two vulnerabilities are caused due to errors within the processing of Internet Video Recording (IVR) files. Please see the vendor's advisory for details. http://service.real.com/realplayer/security/01192010_player/en/
PROVIDED AND/OR DISCOVERED BY: The vendor credits: * Evgeny Legerov * anonymous persons working with iDEFENSE Labs * John Rambo and anonymous researchers working with TippingPoint's Zero Day Initiative
ORIGINAL ADVISORY: http://service.real.com/realplayer/security/01192010_player/en/
OTHER REFERENCES: SA33810: http://secunia.com/advisories/33810/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. ZDI-10-010: RealNetworks RealPlayer Skin Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-010 January 21, 2010
-- CVE ID: CVE-2009-4246
-- Affected Vendors: RealNetworks
-- Affected Products: RealNetworks RealPlayer
-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 8493.
-- Vendor Response: RealNetworks has issued an update to correct this vulnerability.
Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201001-0739",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "10.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "*"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "10.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "(enterprise)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10.5"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.1"
},
{
"model": "realplayer",
"scope": null,
"trust": 0.7,
"vendor": "realnetworks",
"version": null
},
{
"model": "solaris 10 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "solaris 10 sparc",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1741"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1698"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1675"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1663"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1483"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1348"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1235"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1069"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1059"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1056"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1053"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1040"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-010"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001052"
},
{
"db": "NVD",
"id": "CVE-2009-4246"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-249"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_enterprise:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4246"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Evgeny Legerov, anonymous researchers working with iDEFENSE Labs, John Rambo, Peter Vreugdenhil working with TippingPoint\u0027s Zero Day Initiative, and anonymous researchers working with TippingPoint\u0027s Zero Day Initiative",
"sources": [
{
"db": "BID",
"id": "37880"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-249"
}
],
"trust": 0.9
},
"cve": "CVE-2009-4246",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2009-4246",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2009-4246",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-41692",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2009-4246",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2009-4246",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201001-249",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-41692",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-010"
},
{
"db": "VULHUB",
"id": "VHN-41692"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001052"
},
{
"db": "NVD",
"id": "CVE-2009-4246"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-249"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows user-assisted remote attackers to execute arbitrary code via a malformed .RJS skin file that contains a web.xmb file with crafted length values. This vulnerability allows remote attackers to execute code on vulnerable installations of RealNetworks RealPlayer. User interaction is required in that a user must visit a malicious website or open a malicious file and accept a dialog to switch player skins.The specific flaw exists during parsing of malformed RealPlayer .RJS skin files. While loading a skin the application copies certain variable length fields from the extracted file named web.xmb into a statically sized buffer. By crafting these fields appropriately an attack can cause the process to overflow the buffer. This can be leveraged to execute arbitrary code with the privileges of the application. RealPlayer SP, RealPlayer, and Helix Player are prone to multiple remote vulnerabilities, including heap- and stack-based buffer-overflow issues. \nA remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Failed exploit attempts will result in a denial-of-service condition. \nThe following are vulnerable:\nRealPlayer SP 1.0.0 through 1.0.1\nRealPlayer 11 11.0.0 through 11.0.5\nRealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741\nRealPlayer 10 and 10.1\nHelix Player 11.0.0 through 11.0.2. ----------------------------------------------------------------------\n\n\n\nSecunia integrated with Microsoft WSUS \nhttp://secunia.com/blog/71/\n\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38218\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/38218/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in RealPlayer, which can be\nexploited by malicious people to compromise a vulnerable system. \n\n1) An unspecified error related to the RealPlayer ASM Rulebook can be\nexploited to cause a heap-based buffer overflow. \n\n3) A vulnerability is caused due to an unspecified error related to\nHTTP chunk encoding. \n\n5) An unspecified error when processing compressed GIF images can be\nexploited to cause a heap-based buffer overflow. \n\n6) An unspecified error within the RealPlayer SMIL parsing can be\nexploited to cause a heap-based buffer overflow. \n\n8) An unspecified error related to the RealPlayer ASM RuleBook can be\nexploited to cause an \"array overflow\". \n\n9) An unspecified boundary error related to RealPlayer RTSP\n\"set_parameter\" can be exploited to cause a buffer overflow. \n\n10) Two vulnerabilities are caused due to errors within the\nprocessing of Internet Video Recording (IVR) files. Please see the vendor\u0027s advisory for\ndetails. \nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits:\n* Evgeny Legerov\n* anonymous persons working with iDEFENSE Labs\n* John Rambo and anonymous researchers working with TippingPoint\u0027s\nZero Day Initiative\n\nORIGINAL ADVISORY:\nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nOTHER REFERENCES:\nSA33810:\nhttp://secunia.com/advisories/33810/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. ZDI-10-010: RealNetworks RealPlayer Skin Parsing Remote Code Execution Vulnerability\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-010\nJanuary 21, 2010\n\n-- CVE ID:\nCVE-2009-4246\n\n-- Affected Vendors:\nRealNetworks\n\n-- Affected Products:\nRealNetworks RealPlayer\n\n-- TippingPoint(TM) IPS Customer Protection:\nTippingPoint IPS customers have been protected against this\nvulnerability by Digital Vaccine protection filter ID 8493. \n\n-- Vendor Response:\nRealNetworks has issued an update to correct this vulnerability. \n\nResearchers interested in getting paid for their security research\nthrough the ZDI can find more information and sign-up at:\n\n http://www.zerodayinitiative.com\n\nThe ZDI is unique in how the acquired vulnerability information is\nused. TippingPoint does not re-sell the vulnerability details or any\nexploit code. Instead, upon notifying the affected product vendor,\nTippingPoint provides its customers with zero day protection through\nits intrusion prevention technology. Explicit details regarding the\nspecifics of the vulnerability are not exposed to any parties until\nan official vendor patch is publicly available. Furthermore, with the\naltruistic aim of helping to secure a broader user base, TippingPoint\nprovides this vulnerability information confidentially to security\nvendors (including competitors) who have a vulnerability protection or\nmitigation product. \n\nOur vulnerability disclosure policy is available online at:\n\n http://www.zerodayinitiative.com/advisories/disclosure_policy/",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4246"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001052"
},
{
"db": "ZDI",
"id": "ZDI-10-010"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "VULHUB",
"id": "VHN-41692"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85513"
}
],
"trust": 2.79
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-41692",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41692"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-4246",
"trust": 3.6
},
{
"db": "ZDI",
"id": "ZDI-10-010",
"trust": 2.8
},
{
"db": "BID",
"id": "37880",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "38218",
"trust": 2.6
},
{
"db": "SECTRACK",
"id": "1023489",
"trust": 2.5
},
{
"db": "VUPEN",
"id": "ADV-2010-0178",
"trust": 2.5
},
{
"db": "XF",
"id": "55799",
"trust": 1.4
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001052",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-421",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201001-249",
"trust": 0.7
},
{
"db": "BUGTRAQ",
"id": "20100121 ZDI-10-010: REALNETWORKS REALPLAYER SKIN PARSING REMOTE CODE EXECUTION VULNERABILITY",
"trust": 0.6
},
{
"db": "ZDI",
"id": "ZDI-10-008",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-006",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-005",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-007",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "85513",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-41692",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "85439",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-010"
},
{
"db": "VULHUB",
"id": "VHN-41692"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001052"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85513"
},
{
"db": "NVD",
"id": "CVE-2009-4246"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-249"
}
]
},
"id": "VAR-201001-0739",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-41692"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:22:43.335000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/en"
},
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/ja/"
},
{
"title": "RealNetworks has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "http://service.real.com/realplayer/security/01192010_player/en/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-010"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001052"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41692"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001052"
},
{
"db": "NVD",
"id": "CVE-2009-4246"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.9,
"url": "http://service.real.com/realplayer/security/01192010_player/en/"
},
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/37880"
},
{
"trust": 2.5,
"url": "http://securitytracker.com/id?1023489"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/38218"
},
{
"trust": 2.5,
"url": "http://www.vupen.com/english/advisories/2010/0178"
},
{
"trust": 2.0,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-010/"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/55799"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/509104/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55799"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4246"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-4246"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/509104/100/0/threaded"
},
{
"trust": 0.3,
"url": "http://blogs.sun.com/security/entry/cve_2009_4247_buffer_overflow"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=839"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=837"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=838"
},
{
"trust": 0.3,
"url": "http://www.realnetworks.com/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-005/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-006/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-007/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-008/"
},
{
"trust": 0.3,
"url": "/archive/1/509286"
},
{
"trust": 0.3,
"url": "/archive/1/509293"
},
{
"trust": 0.3,
"url": "/archive/1/509288"
},
{
"trust": 0.3,
"url": "/archive/1/509100"
},
{
"trust": 0.3,
"url": "/archive/1/509096"
},
{
"trust": 0.3,
"url": "/archive/1/509105"
},
{
"trust": 0.3,
"url": "/archive/1/509098"
},
{
"trust": 0.3,
"url": "/archive/1/509104"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38218/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/71/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33810/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/disclosure_policy/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-4246"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-010"
},
{
"trust": 0.1,
"url": "http://www.tippingpoint.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-010"
},
{
"db": "VULHUB",
"id": "VHN-41692"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001052"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85513"
},
{
"db": "NVD",
"id": "CVE-2009-4246"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-249"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-10-010"
},
{
"db": "VULHUB",
"id": "VHN-41692"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001052"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85513"
},
{
"db": "NVD",
"id": "CVE-2009-4246"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-249"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-01-21T00:00:00",
"db": "ZDI",
"id": "ZDI-10-010"
},
{
"date": "2010-01-25T00:00:00",
"db": "VULHUB",
"id": "VHN-41692"
},
{
"date": "2010-01-20T00:00:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001052"
},
{
"date": "2010-01-20T16:00:34",
"db": "PACKETSTORM",
"id": "85439"
},
{
"date": "2010-01-22T07:47:10",
"db": "PACKETSTORM",
"id": "85513"
},
{
"date": "2010-01-25T19:30:01.463000",
"db": "NVD",
"id": "CVE-2009-4246"
},
{
"date": "2010-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-249"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-01-21T00:00:00",
"db": "ZDI",
"id": "ZDI-10-010"
},
{
"date": "2018-10-10T00:00:00",
"db": "VULHUB",
"id": "VHN-41692"
},
{
"date": "2010-07-13T20:27:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001052"
},
{
"date": "2018-10-10T19:48:53.243000",
"db": "NVD",
"id": "CVE-2009-4246"
},
{
"date": "2010-01-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-249"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "85513"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-249"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Realnetworks RealPlayer Vulnerable to arbitrary code execution",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001052"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201001-249"
}
],
"trust": 0.6
}
}
VAR-201001-0747
Vulnerability from variot - Updated: 2023-12-18 12:22Buffer overflow in the RTSPProtocol::HandleSetParameterRequest function in client/core/rtspprotocol.cpp in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted RTSP SET_PARAMETER request. Realnetworks RealPlayer Contains a buffer overflow vulnerability.Skillfully crafted by a third party RTSP SET_PARAMETER The request can have an impact related to buffer overflow. RealPlayer SP, RealPlayer, and Helix Player are prone to multiple remote vulnerabilities, including heap- and stack-based buffer-overflow issues. A remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Successful exploits will allow the attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. The following are vulnerable: RealPlayer SP 1.0.0 through 1.0.1 RealPlayer 11 11.0.0 through 11.0.5 RealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741 RealPlayer 10 and 10.1 Helix Player 11.0.0 through 11.0.2. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. ----------------------------------------------------------------------
Secunia integrated with Microsoft WSUS http://secunia.com/blog/71/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38218
VERIFY ADVISORY: http://secunia.com/advisories/38218/
DESCRIPTION: Some vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a vulnerable system.
2) An unspecified error when processing GIF images can be exploited to cause a heap-based buffer overflow.
3) A vulnerability is caused due to an unspecified error related to HTTP chunk encoding.
5) An unspecified error when processing compressed GIF images can be exploited to cause a heap-based buffer overflow.
6) An unspecified error within the RealPlayer SMIL parsing can be exploited to cause a heap-based buffer overflow.
7) An unspecified error within the RealPlayer skin parsing can be exploited to cause a stack-based buffer overflow.
8) An unspecified error related to the RealPlayer ASM RuleBook can be exploited to cause an "array overflow".
10) Two vulnerabilities are caused due to errors within the processing of Internet Video Recording (IVR) files. Please see the vendor's advisory for details. http://service.real.com/realplayer/security/01192010_player/en/
PROVIDED AND/OR DISCOVERED BY: The vendor credits: * Evgeny Legerov * anonymous persons working with iDEFENSE Labs * John Rambo and anonymous researchers working with TippingPoint's Zero Day Initiative
ORIGINAL ADVISORY: http://service.real.com/realplayer/security/01192010_player/en/
OTHER REFERENCES: SA33810: http://secunia.com/advisories/33810/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. iDefense Security Advisory 02.01.10 http://labs.idefense.com/intelligence/vulnerabilities/ Feb 01, 2010
I. BACKGROUND
RealPlayer is an application for playing various media formats, developed by RealNetworks Inc. Since late 2003, Real Player has been based on the open-source Helix Player. More information can be found at the URLs shown. For more information, see the vendor's site found at the following links.
http://www.real.com/realplayer.html http://helixcommunity.org/
II.
This problem specifically exists in the CMediumBlockAllocator::Alloc method. When calculating the size of a memory allocation, an integer overflow occurs. This leads to heap corruption, which can result in the execution of arbitrary code.
III. ANALYSIS
Exploitation of this vulnerability results in the execution of arbitrary code with the privileges of the user executing Real Player.
To be successful, an attacker must persuade a user to use Real Player to view specially crafted media. This could be accomplished via a Web page or direct link to the malicious media.
IV. DETECTION
iDefense has confirmed the existence of this vulnerability in Real Player versions 10.5 (build 6.0.12.883) and 11 (build 6.0.14.738) on Windows. Other versions may also be affected. WORKAROUND
iDefense is currently unaware of any effective workaround for this issue.
VI. VENDOR RESPONSE
RealNetworks has released a patch which addresses this issue. Information about downloadable vendor updates can be found by clicking on the URLs shown.
http://service.real.com/realplayer/security/01192010_player/en/
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2009-4248 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.
VIII. DISCLOSURE TIMELINE
01/11/2008 Initial Contact 01/11/2009 Initial Response 02/01/2010 Coordinated public disclosure.
IX. CREDIT
The discoverer of this vulnerability wishes to remain anonymous.
Get paid for vulnerability research http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events http://labs.idefense.com/
X. LEGAL NOTICES
Copyright \xa9 2010 iDefense, Inc.
Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.
For more information: SA38218
SOLUTION: Updated packages are available via Red Hat Network
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201001-0747",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "10.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "*"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "(enterprise)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10.5"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.1"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (es)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.0"
},
{
"model": "solaris 10 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "solaris 10 sparc",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1741"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1698"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1675"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1663"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1483"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1348"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1235"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1069"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1059"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1056"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1053"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1040"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
}
],
"sources": [
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001054"
},
{
"db": "NVD",
"id": "CVE-2009-4248"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-251"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_enterprise:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4248"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Evgeny Legerov, anonymous researchers working with iDEFENSE Labs, John Rambo, Peter Vreugdenhil working with TippingPoint\u0027s Zero Day Initiative, and anonymous researchers working with TippingPoint\u0027s Zero Day Initiative",
"sources": [
{
"db": "BID",
"id": "37880"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-251"
}
],
"trust": 0.9
},
"cve": "CVE-2009-4248",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2009-4248",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-41694",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2009-4248",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201001-251",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-41694",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41694"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001054"
},
{
"db": "NVD",
"id": "CVE-2009-4248"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-251"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow in the RTSPProtocol::HandleSetParameterRequest function in client/core/rtspprotocol.cpp in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted RTSP SET_PARAMETER request. Realnetworks RealPlayer Contains a buffer overflow vulnerability.Skillfully crafted by a third party RTSP SET_PARAMETER The request can have an impact related to buffer overflow. RealPlayer SP, RealPlayer, and Helix Player are prone to multiple remote vulnerabilities, including heap- and stack-based buffer-overflow issues. \nA remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Successful exploits will allow the attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. \nThe following are vulnerable:\nRealPlayer SP 1.0.0 through 1.0.1\nRealPlayer 11 11.0.0 through 11.0.5\nRealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741\nRealPlayer 10 and 10.1\nHelix Player 11.0.0 through 11.0.2. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. ----------------------------------------------------------------------\n\n\n\nSecunia integrated with Microsoft WSUS \nhttp://secunia.com/blog/71/\n\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38218\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/38218/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in RealPlayer, which can be\nexploited by malicious people to compromise a vulnerable system. \n\n2) An unspecified error when processing GIF images can be exploited\nto cause a heap-based buffer overflow. \n\n3) A vulnerability is caused due to an unspecified error related to\nHTTP chunk encoding. \n\n5) An unspecified error when processing compressed GIF images can be\nexploited to cause a heap-based buffer overflow. \n\n6) An unspecified error within the RealPlayer SMIL parsing can be\nexploited to cause a heap-based buffer overflow. \n\n7) An unspecified error within the RealPlayer skin parsing can be\nexploited to cause a stack-based buffer overflow. \n\n8) An unspecified error related to the RealPlayer ASM RuleBook can be\nexploited to cause an \"array overflow\". \n\n10) Two vulnerabilities are caused due to errors within the\nprocessing of Internet Video Recording (IVR) files. Please see the vendor\u0027s advisory for\ndetails. \nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits:\n* Evgeny Legerov\n* anonymous persons working with iDEFENSE Labs\n* John Rambo and anonymous researchers working with TippingPoint\u0027s\nZero Day Initiative\n\nORIGINAL ADVISORY:\nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nOTHER REFERENCES:\nSA33810:\nhttp://secunia.com/advisories/33810/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. iDefense Security Advisory 02.01.10\nhttp://labs.idefense.com/intelligence/vulnerabilities/\nFeb 01, 2010\n\nI. BACKGROUND\n\nRealPlayer is an application for playing various media formats,\ndeveloped by RealNetworks Inc. Since late 2003, Real Player has been\nbased on the open-source Helix Player. More information can be found at\nthe URLs shown. For more information, see the vendor\u0027s site found at the\nfollowing links. \n\nhttp://www.real.com/realplayer.html\nhttp://helixcommunity.org/\n\nII. \n\nThis problem specifically exists in the CMediumBlockAllocator::Alloc\nmethod. When calculating the size of a memory allocation, an integer\noverflow occurs. This leads to heap corruption, which can result in the\nexecution of arbitrary code. \n\nIII. ANALYSIS\n\nExploitation of this vulnerability results in the execution of arbitrary\ncode with the privileges of the user executing Real Player. \n\nTo be successful, an attacker must persuade a user to use Real Player to\nview specially crafted media. This could be accomplished via a Web page\nor direct link to the malicious media. \n\nIV. DETECTION\n\niDefense has confirmed the existence of this vulnerability in Real\nPlayer versions 10.5 (build 6.0.12.883) and 11 (build 6.0.14.738) on\nWindows. Other versions may also be affected. WORKAROUND\n\niDefense is currently unaware of any effective workaround for this\nissue. \n\nVI. VENDOR RESPONSE\n\nRealNetworks has released a patch which addresses this issue. \nInformation about downloadable vendor updates can be found by clicking\non the URLs shown. \n\nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nVII. CVE INFORMATION\n\nThe Common Vulnerabilities and Exposures (CVE) project has assigned the\nname CVE-2009-4248 to this issue. This is a candidate for inclusion in\nthe CVE list (http://cve.mitre.org/), which standardizes names for\nsecurity problems. \n\nVIII. DISCLOSURE TIMELINE\n\n01/11/2008 Initial Contact\n01/11/2009 Initial Response\n02/01/2010 Coordinated public disclosure. \n\nIX. CREDIT\n\nThe discoverer of this vulnerability wishes to remain anonymous. \n\nGet paid for vulnerability research\nhttp://labs.idefense.com/methodology/vulnerability/vcp.php\n\nFree tools, research and upcoming events\nhttp://labs.idefense.com/\n\nX. LEGAL NOTICES\n\nCopyright \\xa9 2010 iDefense, Inc. \n\nPermission is granted for the redistribution of this alert\nelectronically. It may not be edited in any way without the express\nwritten consent of iDefense. If you wish to reprint the whole or any\npart of this alert in any other medium other than electronically,\nplease e-mail customerservice@idefense.com for permission. \n\nDisclaimer: The information in the advisory is believed to be accurate\nat the time of publishing based on currently available information. Use\nof the information constitutes acceptance for use in an AS IS condition. \n There are no warranties with regard to this information. Neither the\nauthor nor the publisher accepts any liability for any direct,\nindirect, or consequential loss or damage arising from use of, or\nreliance on, this information. \n\nFor more information:\nSA38218\n\nSOLUTION:\nUpdated packages are available via Red Hat Network",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4248"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001054"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "VULHUB",
"id": "VHN-41694"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85842"
},
{
"db": "PACKETSTORM",
"id": "86184"
}
],
"trust": 2.25
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-41694",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41694"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-4248",
"trust": 2.9
},
{
"db": "BID",
"id": "37880",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "38218",
"trust": 2.6
},
{
"db": "SECTRACK",
"id": "1023489",
"trust": 2.5
},
{
"db": "VUPEN",
"id": "ADV-2010-0178",
"trust": 2.5
},
{
"db": "XF",
"id": "55801",
"trust": 1.4
},
{
"db": "SECUNIA",
"id": "38450",
"trust": 1.2
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001054",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201001-251",
"trust": 0.7
},
{
"db": "MLIST",
"id": "[CLIENT-CVS] 20080117 CORE RTSPPROTOCOL.CPP,1.55.2.18,1.55.2.19",
"trust": 0.6
},
{
"db": "MLIST",
"id": "[CLIENT-CVS] 20080117 CORE RTSPPROTOCOL.CPP,1.85,1.86",
"trust": 0.6
},
{
"db": "MLIST",
"id": "[CLIENT-DEV] 20080117 CR: FIX FOR BUG 211210",
"trust": 0.6
},
{
"db": "REDHAT",
"id": "RHSA-2010:0094",
"trust": 0.6
},
{
"db": "ZDI",
"id": "ZDI-10-010",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-008",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-006",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-005",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-007",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "85842",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-41694",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "85439",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "86184",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41694"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001054"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85842"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "NVD",
"id": "CVE-2009-4248"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-251"
}
]
},
"id": "VAR-201001-0747",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-41694"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:22:43.152000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/en"
},
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/ja/"
},
{
"title": "RHSA-2010:0094",
"trust": 0.8,
"url": "http://rhn.redhat.com/errata/rhsa-2010-0094.html"
},
{
"title": "RealPlayerSP",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5472"
},
{
"title": "RealPlayerSPGold",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5471"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5474"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5473"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001054"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-251"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41694"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001054"
},
{
"db": "NVD",
"id": "CVE-2009-4248"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/37880"
},
{
"trust": 2.5,
"url": "http://securitytracker.com/id?1023489"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/38218"
},
{
"trust": 2.5,
"url": "http://www.vupen.com/english/advisories/2010/0178"
},
{
"trust": 2.2,
"url": "http://service.real.com/realplayer/security/01192010_player/en/"
},
{
"trust": 1.7,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=561361"
},
{
"trust": 1.7,
"url": "https://helixcommunity.org/viewcvs/client/core/rtspprotocol.cpp?view=log#rev1.55.2.19"
},
{
"trust": 1.7,
"url": "https://helixcommunity.org/viewcvs/client/core/rtspprotocol.cpp?view=log#rev1.86"
},
{
"trust": 1.7,
"url": "http://lists.helixcommunity.org/pipermail/client-cvs/2008-january/003756.html"
},
{
"trust": 1.7,
"url": "http://lists.helixcommunity.org/pipermail/client-cvs/2008-january/003759.html"
},
{
"trust": 1.7,
"url": "http://lists.helixcommunity.org/pipermail/client-dev/2008-january/004591.html"
},
{
"trust": 1.7,
"url": "http://www.redhat.com/support/errata/rhsa-2010-0094.html"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/55801"
},
{
"trust": 1.1,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a10641"
},
{
"trust": 1.1,
"url": "http://secunia.com/advisories/38450"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55801"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4248"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-4248"
},
{
"trust": 0.3,
"url": "http://blogs.sun.com/security/entry/cve_2009_4247_buffer_overflow"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=839"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=837"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=838"
},
{
"trust": 0.3,
"url": "http://www.realnetworks.com/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-005/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-006/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-007/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-008/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-010/"
},
{
"trust": 0.3,
"url": "/archive/1/509286"
},
{
"trust": 0.3,
"url": "/archive/1/509293"
},
{
"trust": 0.3,
"url": "/archive/1/509288"
},
{
"trust": 0.3,
"url": "/archive/1/509100"
},
{
"trust": 0.3,
"url": "/archive/1/509096"
},
{
"trust": 0.3,
"url": "/archive/1/509105"
},
{
"trust": 0.3,
"url": "/archive/1/509098"
},
{
"trust": 0.3,
"url": "/archive/1/509104"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/38218/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/blog/71/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33810/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-4248"
},
{
"trust": 0.1,
"url": "http://helixcommunity.org/"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/),"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/"
},
{
"trust": 0.1,
"url": "http://www.real.com/realplayer.html"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/methodology/vulnerability/vcp.php"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38450/"
},
{
"trust": 0.1,
"url": "http://rhn.redhat.com"
},
{
"trust": 0.1,
"url": "http://rhn.redhat.com/errata/rhsa-2010-0094.html"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41694"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001054"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85842"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "NVD",
"id": "CVE-2009-4248"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-251"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-41694"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001054"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85842"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "NVD",
"id": "CVE-2009-4248"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-251"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-01-25T00:00:00",
"db": "VULHUB",
"id": "VHN-41694"
},
{
"date": "2010-01-20T00:00:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001054"
},
{
"date": "2010-01-20T16:00:34",
"db": "PACKETSTORM",
"id": "85439"
},
{
"date": "2010-02-02T02:24:47",
"db": "PACKETSTORM",
"id": "85842"
},
{
"date": "2010-02-11T10:10:16",
"db": "PACKETSTORM",
"id": "86184"
},
{
"date": "2010-01-25T19:30:01.543000",
"db": "NVD",
"id": "CVE-2009-4248"
},
{
"date": "2010-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-251"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-19T00:00:00",
"db": "VULHUB",
"id": "VHN-41694"
},
{
"date": "2010-07-13T20:27:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001054"
},
{
"date": "2017-09-19T01:29:56.657000",
"db": "NVD",
"id": "CVE-2009-4248"
},
{
"date": "2011-07-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-251"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "85842"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-251"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Realnetworks RealPlayer Vulnerable to buffer overflow",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001054"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201001-251"
}
],
"trust": 0.6
}
}
VAR-201001-0742
Vulnerability from variot - Updated: 2023-12-18 12:22Heap-based buffer overflow in datatype/smil/common/smlpkt.cpp in smlrender.dll in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10 and 11.0.0, and Helix Player 10.x and 11.0.0 allows remote attackers to execute arbitrary code via an SMIL file with crafted string lengths. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the smlrender.dll library responsible for parsing SMIL files. A lack of proper string length checks can result in the overflow of a static heap buffer. Exploitation of this overflow can lead to arbitrary code execution under the context of the user running the process. RealPlayer SP, RealPlayer, and Helix Player are prone to multiple remote vulnerabilities, including heap- and stack-based buffer-overflow issues. A remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Failed exploit attempts will result in a denial-of-service condition. The following are vulnerable: RealPlayer SP 1.0.0 through 1.0.1 RealPlayer 11 11.0.0 through 11.0.5 RealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741 RealPlayer 10 and 10.1 Helix Player 11.0.0 through 11.0.2. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. 0 version, Helix Player 10.x and 11.0.0 versions. ----------------------------------------------------------------------
Secunia integrated with Microsoft WSUS http://secunia.com/blog/71/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38218
VERIFY ADVISORY: http://secunia.com/advisories/38218/
DESCRIPTION: Some vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a vulnerable system.
1) An unspecified error related to the RealPlayer ASM Rulebook can be exploited to cause a heap-based buffer overflow.
2) An unspecified error when processing GIF images can be exploited to cause a heap-based buffer overflow.
3) A vulnerability is caused due to an unspecified error related to HTTP chunk encoding.
4) An unspecified error within the RealPlayer SIPR codec can be exploited to cause a heap-based buffer overflow.
5) An unspecified error when processing compressed GIF images can be exploited to cause a heap-based buffer overflow.
6) An unspecified error within the RealPlayer SMIL parsing can be exploited to cause a heap-based buffer overflow.
7) An unspecified error within the RealPlayer skin parsing can be exploited to cause a stack-based buffer overflow.
8) An unspecified error related to the RealPlayer ASM RuleBook can be exploited to cause an "array overflow".
9) An unspecified boundary error related to RealPlayer RTSP "set_parameter" can be exploited to cause a buffer overflow.
10) Two vulnerabilities are caused due to errors within the processing of Internet Video Recording (IVR) files. Please see the vendor's advisory for details. http://service.real.com/realplayer/security/01192010_player/en/
PROVIDED AND/OR DISCOVERED BY: The vendor credits: * Evgeny Legerov * anonymous persons working with iDEFENSE Labs * John Rambo and anonymous researchers working with TippingPoint's Zero Day Initiative
ORIGINAL ADVISORY: http://service.real.com/realplayer/security/01192010_player/en/
OTHER REFERENCES: SA33810: http://secunia.com/advisories/33810/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
.
For more information: SA38218
SOLUTION: Updated packages are available via Red Hat Network. ZDI-10-007: RealNetworks RealPlayer SMIL getAtom Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-007 January 21, 2010
-- CVE ID: CVE-2009-4257
-- Affected Vendors: RealNetworks
-- Affected Products: RealNetworks RealPlayer
-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 5907.
-- Vendor Response: RealNetworks has issued an update to correct this vulnerability.
Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201001-0742",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "10.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "*"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "(enterprise)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10.5"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.1"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (es)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.0"
},
{
"model": "realplayer",
"scope": null,
"trust": 0.7,
"vendor": "realnetworks",
"version": null
},
{
"model": "solaris 10 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "solaris 10 sparc",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1741"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1698"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1675"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1663"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1483"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1348"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1235"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1069"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1059"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1056"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1053"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1040"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-007"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001051"
},
{
"db": "NVD",
"id": "CVE-2009-4257"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-252"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_enterprise:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4257"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Evgeny Legerov, anonymous researchers working with iDEFENSE Labs, John Rambo, Peter Vreugdenhil working with TippingPoint\u0027s Zero Day Initiative, and anonymous researchers working with TippingPoint\u0027s Zero Day Initiative",
"sources": [
{
"db": "BID",
"id": "37880"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-252"
}
],
"trust": 0.9
},
"cve": "CVE-2009-4257",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2009-4257",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2009-4257",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-41703",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2009-4257",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2009-4257",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201001-252",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-41703",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-007"
},
{
"db": "VULHUB",
"id": "VHN-41703"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001051"
},
{
"db": "NVD",
"id": "CVE-2009-4257"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-252"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in datatype/smil/common/smlpkt.cpp in smlrender.dll in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10 and 11.0.0, and Helix Player 10.x and 11.0.0 allows remote attackers to execute arbitrary code via an SMIL file with crafted string lengths. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the smlrender.dll library responsible for parsing SMIL files. A lack of proper string length checks can result in the overflow of a static heap buffer. Exploitation of this overflow can lead to arbitrary code execution under the context of the user running the process. RealPlayer SP, RealPlayer, and Helix Player are prone to multiple remote vulnerabilities, including heap- and stack-based buffer-overflow issues. \nA remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Failed exploit attempts will result in a denial-of-service condition. \nThe following are vulnerable:\nRealPlayer SP 1.0.0 through 1.0.1\nRealPlayer 11 11.0.0 through 11.0.5\nRealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741\nRealPlayer 10 and 10.1\nHelix Player 11.0.0 through 11.0.2. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. 0 version, Helix Player 10.x and 11.0.0 versions. ----------------------------------------------------------------------\n\n\n\nSecunia integrated with Microsoft WSUS \nhttp://secunia.com/blog/71/\n\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38218\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/38218/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in RealPlayer, which can be\nexploited by malicious people to compromise a vulnerable system. \n\n1) An unspecified error related to the RealPlayer ASM Rulebook can be\nexploited to cause a heap-based buffer overflow. \n\n2) An unspecified error when processing GIF images can be exploited\nto cause a heap-based buffer overflow. \n\n3) A vulnerability is caused due to an unspecified error related to\nHTTP chunk encoding. \n\n4) An unspecified error within the RealPlayer SIPR codec can be\nexploited to cause a heap-based buffer overflow. \n\n5) An unspecified error when processing compressed GIF images can be\nexploited to cause a heap-based buffer overflow. \n\n6) An unspecified error within the RealPlayer SMIL parsing can be\nexploited to cause a heap-based buffer overflow. \n\n7) An unspecified error within the RealPlayer skin parsing can be\nexploited to cause a stack-based buffer overflow. \n\n8) An unspecified error related to the RealPlayer ASM RuleBook can be\nexploited to cause an \"array overflow\". \n\n9) An unspecified boundary error related to RealPlayer RTSP\n\"set_parameter\" can be exploited to cause a buffer overflow. \n\n10) Two vulnerabilities are caused due to errors within the\nprocessing of Internet Video Recording (IVR) files. Please see the vendor\u0027s advisory for\ndetails. \nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits:\n* Evgeny Legerov\n* anonymous persons working with iDEFENSE Labs\n* John Rambo and anonymous researchers working with TippingPoint\u0027s\nZero Day Initiative\n\nORIGINAL ADVISORY:\nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nOTHER REFERENCES:\nSA33810:\nhttp://secunia.com/advisories/33810/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\nFor more information:\nSA38218\n\nSOLUTION:\nUpdated packages are available via Red Hat Network. ZDI-10-007: RealNetworks RealPlayer SMIL getAtom Remote Code Execution Vulnerability\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-007\nJanuary 21, 2010\n\n-- CVE ID:\nCVE-2009-4257\n\n-- Affected Vendors:\nRealNetworks\n\n-- Affected Products:\nRealNetworks RealPlayer\n\n-- TippingPoint(TM) IPS Customer Protection:\nTippingPoint IPS customers have been protected against this\nvulnerability by Digital Vaccine protection filter ID 5907. \n\n-- Vendor Response:\nRealNetworks has issued an update to correct this vulnerability. \n\nResearchers interested in getting paid for their security research\nthrough the ZDI can find more information and sign-up at:\n\n http://www.zerodayinitiative.com\n\nThe ZDI is unique in how the acquired vulnerability information is\nused. TippingPoint does not re-sell the vulnerability details or any\nexploit code. Instead, upon notifying the affected product vendor,\nTippingPoint provides its customers with zero day protection through\nits intrusion prevention technology. Explicit details regarding the\nspecifics of the vulnerability are not exposed to any parties until\nan official vendor patch is publicly available. Furthermore, with the\naltruistic aim of helping to secure a broader user base, TippingPoint\nprovides this vulnerability information confidentially to security\nvendors (including competitors) who have a vulnerability protection or\nmitigation product. \n\nOur vulnerability disclosure policy is available online at:\n\n http://www.zerodayinitiative.com/advisories/disclosure_policy/",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4257"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001051"
},
{
"db": "ZDI",
"id": "ZDI-10-007"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "VULHUB",
"id": "VHN-41703"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "PACKETSTORM",
"id": "85507"
}
],
"trust": 2.88
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-41703",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41703"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-4257",
"trust": 3.6
},
{
"db": "ZDI",
"id": "ZDI-10-007",
"trust": 2.8
},
{
"db": "BID",
"id": "37880",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "38218",
"trust": 2.6
},
{
"db": "SECTRACK",
"id": "1023489",
"trust": 2.5
},
{
"db": "VUPEN",
"id": "ADV-2010-0178",
"trust": 2.5
},
{
"db": "XF",
"id": "55798",
"trust": 1.4
},
{
"db": "SECUNIA",
"id": "38450",
"trust": 1.2
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001051",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-286",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201001-252",
"trust": 0.7
},
{
"db": "MLIST",
"id": "[DATATYPE-CVS] 20080916 SMIL/COMMON SMLPKT.CPP,1.11,1.12",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20100121 ZDI-10-007: REALNETWORKS REALPLAYER SMIL GETATOM REMOTE CODE EXECUTION VULNERABILITY",
"trust": 0.6
},
{
"db": "REDHAT",
"id": "RHSA-2010:0094",
"trust": 0.6
},
{
"db": "ZDI",
"id": "ZDI-10-010",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-008",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-006",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-005",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "85507",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-41703",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "85439",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "86184",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-007"
},
{
"db": "VULHUB",
"id": "VHN-41703"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001051"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "PACKETSTORM",
"id": "85507"
},
{
"db": "NVD",
"id": "CVE-2009-4257"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-252"
}
]
},
"id": "VAR-201001-0742",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-41703"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:22:43.241000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/en"
},
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/ja/"
},
{
"title": "RHSA-2010:0094",
"trust": 0.8,
"url": "http://rhn.redhat.com/errata/rhsa-2010-0094.html"
},
{
"title": "RealNetworks has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "http://service.real.com/realplayer/security/01192010_player/en/"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5474"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5473"
},
{
"title": "RealPlayerSP",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5472"
},
{
"title": "RealPlayerSPGold",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5471"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-007"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001051"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-252"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41703"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001051"
},
{
"db": "NVD",
"id": "CVE-2009-4257"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.9,
"url": "http://service.real.com/realplayer/security/01192010_player/en/"
},
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/37880"
},
{
"trust": 2.5,
"url": "http://securitytracker.com/id?1023489"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/38218"
},
{
"trust": 2.5,
"url": "http://www.vupen.com/english/advisories/2010/0178"
},
{
"trust": 2.0,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-007/"
},
{
"trust": 1.7,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=561309"
},
{
"trust": 1.7,
"url": "https://helixcommunity.org/viewcvs/datatype/smil/common/smlpkt.cpp?view=log#rev1.12"
},
{
"trust": 1.7,
"url": "http://lists.helixcommunity.org/pipermail/datatype-cvs/2008-september/008678.html"
},
{
"trust": 1.7,
"url": "http://www.redhat.com/support/errata/rhsa-2010-0094.html"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/55798"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/509105/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a11110"
},
{
"trust": 1.1,
"url": "http://secunia.com/advisories/38450"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55798"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4257"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-4257"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/509105/100/0/threaded"
},
{
"trust": 0.3,
"url": "http://blogs.sun.com/security/entry/cve_2009_4247_buffer_overflow"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=839"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=837"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=838"
},
{
"trust": 0.3,
"url": "http://www.realnetworks.com/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-005/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-006/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-008/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-010/"
},
{
"trust": 0.3,
"url": "/archive/1/509286"
},
{
"trust": 0.3,
"url": "/archive/1/509293"
},
{
"trust": 0.3,
"url": "/archive/1/509288"
},
{
"trust": 0.3,
"url": "/archive/1/509100"
},
{
"trust": 0.3,
"url": "/archive/1/509096"
},
{
"trust": 0.3,
"url": "/archive/1/509105"
},
{
"trust": 0.3,
"url": "/archive/1/509098"
},
{
"trust": 0.3,
"url": "/archive/1/509104"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/38218/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/blog/71/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33810/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38450/"
},
{
"trust": 0.1,
"url": "http://rhn.redhat.com"
},
{
"trust": 0.1,
"url": "http://rhn.redhat.com/errata/rhsa-2010-0094.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/disclosure_policy/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-4257"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-007"
},
{
"trust": 0.1,
"url": "http://www.tippingpoint.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-007"
},
{
"db": "VULHUB",
"id": "VHN-41703"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001051"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "PACKETSTORM",
"id": "85507"
},
{
"db": "NVD",
"id": "CVE-2009-4257"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-252"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-10-007"
},
{
"db": "VULHUB",
"id": "VHN-41703"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001051"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "PACKETSTORM",
"id": "85507"
},
{
"db": "NVD",
"id": "CVE-2009-4257"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-252"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-01-21T00:00:00",
"db": "ZDI",
"id": "ZDI-10-007"
},
{
"date": "2010-01-25T00:00:00",
"db": "VULHUB",
"id": "VHN-41703"
},
{
"date": "2010-01-20T00:00:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001051"
},
{
"date": "2010-01-20T16:00:34",
"db": "PACKETSTORM",
"id": "85439"
},
{
"date": "2010-02-11T10:10:16",
"db": "PACKETSTORM",
"id": "86184"
},
{
"date": "2010-01-22T07:39:11",
"db": "PACKETSTORM",
"id": "85507"
},
{
"date": "2010-01-25T19:30:01.573000",
"db": "NVD",
"id": "CVE-2009-4257"
},
{
"date": "2010-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-252"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-01-21T00:00:00",
"db": "ZDI",
"id": "ZDI-10-007"
},
{
"date": "2018-10-10T00:00:00",
"db": "VULHUB",
"id": "VHN-41703"
},
{
"date": "2010-07-13T20:27:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001051"
},
{
"date": "2018-10-10T19:48:56.100000",
"db": "NVD",
"id": "CVE-2009-4257"
},
{
"date": "2011-07-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-252"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201001-252"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Realnetworks RealPlayer of smlrender.dll Vulnerable to arbitrary code execution",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001051"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201001-252"
}
],
"trust": 0.6
}
}
VAR-201001-0741
Vulnerability from variot - Updated: 2023-12-18 12:22Heap-based buffer overflow in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via an SIPR codec field with a small length value that triggers incorrect memory allocation. This vulnerability allows remote attackers to execute code on vulnerable installations of RealNetworks RealPlayer. User interaction is required in that a user must open a malicious file or visit a malicious web site.The specific flaw exists during the parsing of SIPR codec fields. Specifying a small length value can trigger an undersized heap allocation. This buffer can then subsequently be overflowed. This vulnerability can result in arbitrary code execution under the context of the currently logged in user. RealPlayer SP, RealPlayer, and Helix Player are prone to multiple remote vulnerabilities, including heap- and stack-based buffer-overflow issues. A remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Failed exploit attempts will result in a denial-of-service condition. The following are vulnerable: RealPlayer SP 1.0.0 through 1.0.1 RealPlayer 11 11.0.0 through 11.0.5 RealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741 RealPlayer 10 and 10.1 Helix Player 11.0.0 through 11.0.2. A heap buffer overflow vulnerability exists in version x. ----------------------------------------------------------------------
Secunia integrated with Microsoft WSUS http://secunia.com/blog/71/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38218
VERIFY ADVISORY: http://secunia.com/advisories/38218/
DESCRIPTION: Some vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a vulnerable system.
1) An unspecified error related to the RealPlayer ASM Rulebook can be exploited to cause a heap-based buffer overflow.
2) An unspecified error when processing GIF images can be exploited to cause a heap-based buffer overflow.
3) A vulnerability is caused due to an unspecified error related to HTTP chunk encoding.
4) An unspecified error within the RealPlayer SIPR codec can be exploited to cause a heap-based buffer overflow.
5) An unspecified error when processing compressed GIF images can be exploited to cause a heap-based buffer overflow.
6) An unspecified error within the RealPlayer SMIL parsing can be exploited to cause a heap-based buffer overflow.
7) An unspecified error within the RealPlayer skin parsing can be exploited to cause a stack-based buffer overflow.
8) An unspecified error related to the RealPlayer ASM RuleBook can be exploited to cause an "array overflow".
9) An unspecified boundary error related to RealPlayer RTSP "set_parameter" can be exploited to cause a buffer overflow.
10) Two vulnerabilities are caused due to errors within the processing of Internet Video Recording (IVR) files. Please see the vendor's advisory for details. http://service.real.com/realplayer/security/01192010_player/en/
PROVIDED AND/OR DISCOVERED BY: The vendor credits: * Evgeny Legerov * anonymous persons working with iDEFENSE Labs * John Rambo and anonymous researchers working with TippingPoint's Zero Day Initiative
ORIGINAL ADVISORY: http://service.real.com/realplayer/security/01192010_player/en/
OTHER REFERENCES: SA33810: http://secunia.com/advisories/33810/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. ZDI-10-008: RealNetworks RealPlayer SIPR Codec Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-008 January 21, 2010
-- CVE ID: CVE-2009-4244
-- Affected Vendors: RealNetworks
-- Affected Products: RealNetworks RealPlayer
-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 6514.
-- Vendor Response: RealNetworks has issued an update to correct this vulnerability.
Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201001-0741",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "10.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "*"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.9,
"vendor": "realnetworks",
"version": null
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "(enterprise)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10.5"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.1"
},
{
"model": "realplayer",
"scope": null,
"trust": 0.7,
"vendor": "realnetworks",
"version": null
},
{
"model": "solaris 10 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "solaris 10 sparc",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1741"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1698"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1675"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1663"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1483"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1348"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1235"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1069"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1059"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1056"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1053"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1040"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-008"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001049"
},
{
"db": "NVD",
"id": "CVE-2009-4244"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-244"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_enterprise:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4244"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Evgeny Legerov, anonymous researchers working with iDEFENSE Labs, John Rambo, Peter Vreugdenhil working with TippingPoint\u0027s Zero Day Initiative, and anonymous researchers working with TippingPoint\u0027s Zero Day Initiative",
"sources": [
{
"db": "BID",
"id": "37880"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-244"
}
],
"trust": 0.9
},
"cve": "CVE-2009-4244",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2009-4244",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2009-4244",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-41690",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2009-4244",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2009-4244",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201001-244",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-41690",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-008"
},
{
"db": "VULHUB",
"id": "VHN-41690"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001049"
},
{
"db": "NVD",
"id": "CVE-2009-4244"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-244"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via an SIPR codec field with a small length value that triggers incorrect memory allocation. This vulnerability allows remote attackers to execute code on vulnerable installations of RealNetworks RealPlayer. User interaction is required in that a user must open a malicious file or visit a malicious web site.The specific flaw exists during the parsing of SIPR codec fields. Specifying a small length value can trigger an undersized heap allocation. This buffer can then subsequently be overflowed. This vulnerability can result in arbitrary code execution under the context of the currently logged in user. RealPlayer SP, RealPlayer, and Helix Player are prone to multiple remote vulnerabilities, including heap- and stack-based buffer-overflow issues. \nA remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Failed exploit attempts will result in a denial-of-service condition. \nThe following are vulnerable:\nRealPlayer SP 1.0.0 through 1.0.1\nRealPlayer 11 11.0.0 through 11.0.5\nRealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741\nRealPlayer 10 and 10.1\nHelix Player 11.0.0 through 11.0.2. A heap buffer overflow vulnerability exists in version x. ----------------------------------------------------------------------\n\n\n\nSecunia integrated with Microsoft WSUS \nhttp://secunia.com/blog/71/\n\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38218\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/38218/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in RealPlayer, which can be\nexploited by malicious people to compromise a vulnerable system. \n\n1) An unspecified error related to the RealPlayer ASM Rulebook can be\nexploited to cause a heap-based buffer overflow. \n\n2) An unspecified error when processing GIF images can be exploited\nto cause a heap-based buffer overflow. \n\n3) A vulnerability is caused due to an unspecified error related to\nHTTP chunk encoding. \n\n4) An unspecified error within the RealPlayer SIPR codec can be\nexploited to cause a heap-based buffer overflow. \n\n5) An unspecified error when processing compressed GIF images can be\nexploited to cause a heap-based buffer overflow. \n\n6) An unspecified error within the RealPlayer SMIL parsing can be\nexploited to cause a heap-based buffer overflow. \n\n7) An unspecified error within the RealPlayer skin parsing can be\nexploited to cause a stack-based buffer overflow. \n\n8) An unspecified error related to the RealPlayer ASM RuleBook can be\nexploited to cause an \"array overflow\". \n\n9) An unspecified boundary error related to RealPlayer RTSP\n\"set_parameter\" can be exploited to cause a buffer overflow. \n\n10) Two vulnerabilities are caused due to errors within the\nprocessing of Internet Video Recording (IVR) files. Please see the vendor\u0027s advisory for\ndetails. \nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits:\n* Evgeny Legerov\n* anonymous persons working with iDEFENSE Labs\n* John Rambo and anonymous researchers working with TippingPoint\u0027s\nZero Day Initiative\n\nORIGINAL ADVISORY:\nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nOTHER REFERENCES:\nSA33810:\nhttp://secunia.com/advisories/33810/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. ZDI-10-008: RealNetworks RealPlayer SIPR Codec Remote Code Execution Vulnerability\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-008\nJanuary 21, 2010\n\n-- CVE ID:\nCVE-2009-4244\n\n-- Affected Vendors:\nRealNetworks\n\n-- Affected Products:\nRealNetworks RealPlayer\n\n-- TippingPoint(TM) IPS Customer Protection:\nTippingPoint IPS customers have been protected against this\nvulnerability by Digital Vaccine protection filter ID 6514. \n\n-- Vendor Response:\nRealNetworks has issued an update to correct this vulnerability. \n\nResearchers interested in getting paid for their security research\nthrough the ZDI can find more information and sign-up at:\n\n http://www.zerodayinitiative.com\n\nThe ZDI is unique in how the acquired vulnerability information is\nused. TippingPoint does not re-sell the vulnerability details or any\nexploit code. Instead, upon notifying the affected product vendor,\nTippingPoint provides its customers with zero day protection through\nits intrusion prevention technology. Explicit details regarding the\nspecifics of the vulnerability are not exposed to any parties until\nan official vendor patch is publicly available. Furthermore, with the\naltruistic aim of helping to secure a broader user base, TippingPoint\nprovides this vulnerability information confidentially to security\nvendors (including competitors) who have a vulnerability protection or\nmitigation product. \n\nOur vulnerability disclosure policy is available online at:\n\n http://www.zerodayinitiative.com/advisories/disclosure_policy/",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4244"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001049"
},
{
"db": "ZDI",
"id": "ZDI-10-008"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "VULHUB",
"id": "VHN-41690"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85508"
}
],
"trust": 2.79
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-41690",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41690"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-4244",
"trust": 3.6
},
{
"db": "ZDI",
"id": "ZDI-10-008",
"trust": 2.8
},
{
"db": "BID",
"id": "37880",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "38218",
"trust": 2.6
},
{
"db": "SECTRACK",
"id": "1023489",
"trust": 2.5
},
{
"db": "VUPEN",
"id": "ADV-2010-0178",
"trust": 2.5
},
{
"db": "XF",
"id": "55797",
"trust": 1.4
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001049",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-317",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201001-244",
"trust": 0.7
},
{
"db": "BUGTRAQ",
"id": "20100121 ZDI-10-008: REALNETWORKS REALPLAYER SIPR CODEC REMOTE CODE EXECUTION VULNERABILITY",
"trust": 0.6
},
{
"db": "ZDI",
"id": "ZDI-10-010",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-006",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-005",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-007",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "85508",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-41690",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "85439",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-008"
},
{
"db": "VULHUB",
"id": "VHN-41690"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001049"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85508"
},
{
"db": "NVD",
"id": "CVE-2009-4244"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-244"
}
]
},
"id": "VAR-201001-0741",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-41690"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:22:43.033000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/en"
},
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/ja/"
},
{
"title": "RealNetworks has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "http://service.real.com/realplayer/security/01192010_player/en/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-008"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001049"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41690"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001049"
},
{
"db": "NVD",
"id": "CVE-2009-4244"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.9,
"url": "http://service.real.com/realplayer/security/01192010_player/en/"
},
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/37880"
},
{
"trust": 2.5,
"url": "http://securitytracker.com/id?1023489"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/38218"
},
{
"trust": 2.5,
"url": "http://www.vupen.com/english/advisories/2010/0178"
},
{
"trust": 2.0,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-008/"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/55797"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/509098/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55797"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4244"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-4244"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/509098/100/0/threaded"
},
{
"trust": 0.3,
"url": "http://blogs.sun.com/security/entry/cve_2009_4247_buffer_overflow"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=839"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=837"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=838"
},
{
"trust": 0.3,
"url": "http://www.realnetworks.com/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-005/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-006/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-007/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-010/"
},
{
"trust": 0.3,
"url": "/archive/1/509286"
},
{
"trust": 0.3,
"url": "/archive/1/509293"
},
{
"trust": 0.3,
"url": "/archive/1/509288"
},
{
"trust": 0.3,
"url": "/archive/1/509100"
},
{
"trust": 0.3,
"url": "/archive/1/509096"
},
{
"trust": 0.3,
"url": "/archive/1/509105"
},
{
"trust": 0.3,
"url": "/archive/1/509098"
},
{
"trust": 0.3,
"url": "/archive/1/509104"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38218/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/71/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33810/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/disclosure_policy/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-008"
},
{
"trust": 0.1,
"url": "http://www.tippingpoint.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-4244"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-008"
},
{
"db": "VULHUB",
"id": "VHN-41690"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001049"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85508"
},
{
"db": "NVD",
"id": "CVE-2009-4244"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-244"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-10-008"
},
{
"db": "VULHUB",
"id": "VHN-41690"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001049"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85508"
},
{
"db": "NVD",
"id": "CVE-2009-4244"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-244"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-01-21T00:00:00",
"db": "ZDI",
"id": "ZDI-10-008"
},
{
"date": "2010-01-25T00:00:00",
"db": "VULHUB",
"id": "VHN-41690"
},
{
"date": "2010-01-20T00:00:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001049"
},
{
"date": "2010-01-20T16:00:34",
"db": "PACKETSTORM",
"id": "85439"
},
{
"date": "2010-01-22T07:39:24",
"db": "PACKETSTORM",
"id": "85508"
},
{
"date": "2010-01-25T19:30:01.400000",
"db": "NVD",
"id": "CVE-2009-4244"
},
{
"date": "2010-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-244"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-01-21T00:00:00",
"db": "ZDI",
"id": "ZDI-10-008"
},
{
"date": "2018-10-10T00:00:00",
"db": "VULHUB",
"id": "VHN-41690"
},
{
"date": "2010-07-13T20:27:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001049"
},
{
"date": "2018-10-10T19:48:52.273000",
"db": "NVD",
"id": "CVE-2009-4244"
},
{
"date": "2010-01-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-244"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "85508"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-244"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Realnetworks RealPlayer Vulnerable to arbitrary code execution",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001049"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201001-244"
}
],
"trust": 0.6
}
}
VAR-201001-0745
Vulnerability from variot - Updated: 2023-12-18 12:22Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a compressed GIF file, related to gifcodec.cpp and gifimage.cpp. Realnetworks RealPlayer Contains a heap-based buffer overflow vulnerability.Compressed by a third party GIF Via files, you may be affected by a heap-based buffer overflow. RealPlayer SP, RealPlayer, and Helix Player are prone to multiple remote vulnerabilities, including heap- and stack-based buffer-overflow issues. A remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Successful exploits will allow the attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. The following are vulnerable: RealPlayer SP 1.0.0 through 1.0.1 RealPlayer 11 11.0.0 through 11.0.5 RealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741 RealPlayer 10 and 10.1 Helix Player 11.0.0 through 11.0.2. ----------------------------------------------------------------------
Secunia integrated with Microsoft WSUS http://secunia.com/blog/71/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38218
VERIFY ADVISORY: http://secunia.com/advisories/38218/
DESCRIPTION: Some vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a vulnerable system.
3) A vulnerability is caused due to an unspecified error related to HTTP chunk encoding.
8) An unspecified error related to the RealPlayer ASM RuleBook can be exploited to cause an "array overflow".
10) Two vulnerabilities are caused due to errors within the processing of Internet Video Recording (IVR) files. Please see the vendor's advisory for details. http://service.real.com/realplayer/security/01192010_player/en/
PROVIDED AND/OR DISCOVERED BY: The vendor credits: * Evgeny Legerov * anonymous persons working with iDEFENSE Labs * John Rambo and anonymous researchers working with TippingPoint's Zero Day Initiative
ORIGINAL ADVISORY: http://service.real.com/realplayer/security/01192010_player/en/
OTHER REFERENCES: SA33810: http://secunia.com/advisories/33810/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
For more information: SA38218
SOLUTION: Updated packages are available via Red Hat Network. iDefense Security Advisory 02.01.10 http://labs.idefense.com/intelligence/vulnerabilities/ Feb 01, 2010
I. BACKGROUND
RealPlayer is an application for playing various media formats, developed by RealNetworks Inc. Since late 2003, Real Player has been based on the open-source Helix Player. More information can be found at the URLs shown. For more information, see the vendor's site found at the following links.
http://www.real.com/realplayer.html http://helixcommunity.org/
II. The vulnerability occurs in the CGIFCodec::InitDecompress() function, which does not properly validate a field in the GIF file before using it in an arithmetic operation that calculates the size of a heap buffer. This issue leads to heap corruption, which can result in the execution of arbitrary code.
III. An attacker would need to entice a victim into opening a RTSP stream. Upon the victim opening the stream, the attack would inject a malformed compressed GIF image into a RTSP stream to exploit this issue. Other attack vectors are likely to exist; however, this was the vector tested within iDefense Labs. It should be noted that RealPlayer can be instantiated within a Web browser. This means an attacker could host a malicious Web page and entice a victim into visiting this page. Upon visiting the page, exploitation would occur.
IV. DETECTION
iDefense confirmed RealPlayer version 11 is vulnerable to this issue. WORKAROUND
iDefense recommends applying the following workarounds until a patch resolving this issue is made publicly available by Real Networks Inc. RealPlayer users should change the GIF filetype association to another application. It is also recommended that RealPlayer users disable the RealPlayer plugins contained within the Web browsers plugins directory by changing the file permissions to deny execution of these files. These workarounds will limit the functionality of RealPlayer by disabling GIF support and web browser plugin features. These workarounds may not mitigate all exploitation vectors but will likely prevent the majority of likely scenarios.
VI. VENDOR RESPONSE
RealNetworks has released a patch which addresses this issue. Information about downloadable vendor updates can be found by clicking on the URLs shown.
http://service.real.com/realplayer/security/01192010_player/en/
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2009-4245 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.
VIII. DISCLOSURE TIMELINE
05/13/2008 Initial Contact 05/03/2008 Initial Response 02/01/2010 Coordinated public disclosure.
IX. CREDIT
The discoverer of this vulnerability wishes to remain anonymous.
Get paid for vulnerability research http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events http://labs.idefense.com/
X. LEGAL NOTICES
Copyright \xa9 2010 iDefense, Inc.
Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201001-0745",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "10.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "*"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "(enterprise)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10.5"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.1"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (es)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.0"
},
{
"model": "solaris 10 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "solaris 10 sparc",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1741"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1698"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1675"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1663"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1483"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1348"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1235"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1069"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1059"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1056"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1053"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1040"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
}
],
"sources": [
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001050"
},
{
"db": "NVD",
"id": "CVE-2009-4245"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-246"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_enterprise:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4245"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Evgeny Legerov, anonymous researchers working with iDEFENSE Labs, John Rambo, Peter Vreugdenhil working with TippingPoint\u0027s Zero Day Initiative, and anonymous researchers working with TippingPoint\u0027s Zero Day Initiative",
"sources": [
{
"db": "BID",
"id": "37880"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-246"
}
],
"trust": 0.9
},
"cve": "CVE-2009-4245",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2009-4245",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-41691",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2009-4245",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201001-246",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-41691",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41691"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001050"
},
{
"db": "NVD",
"id": "CVE-2009-4245"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-246"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a compressed GIF file, related to gifcodec.cpp and gifimage.cpp. Realnetworks RealPlayer Contains a heap-based buffer overflow vulnerability.Compressed by a third party GIF Via files, you may be affected by a heap-based buffer overflow. RealPlayer SP, RealPlayer, and Helix Player are prone to multiple remote vulnerabilities, including heap- and stack-based buffer-overflow issues. \nA remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Successful exploits will allow the attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. \nThe following are vulnerable:\nRealPlayer SP 1.0.0 through 1.0.1\nRealPlayer 11 11.0.0 through 11.0.5\nRealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741\nRealPlayer 10 and 10.1\nHelix Player 11.0.0 through 11.0.2. ----------------------------------------------------------------------\n\n\n\nSecunia integrated with Microsoft WSUS \nhttp://secunia.com/blog/71/\n\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38218\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/38218/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in RealPlayer, which can be\nexploited by malicious people to compromise a vulnerable system. \n\n3) A vulnerability is caused due to an unspecified error related to\nHTTP chunk encoding. \n\n8) An unspecified error related to the RealPlayer ASM RuleBook can be\nexploited to cause an \"array overflow\". \n\n10) Two vulnerabilities are caused due to errors within the\nprocessing of Internet Video Recording (IVR) files. Please see the vendor\u0027s advisory for\ndetails. \nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits:\n* Evgeny Legerov\n* anonymous persons working with iDEFENSE Labs\n* John Rambo and anonymous researchers working with TippingPoint\u0027s\nZero Day Initiative\n\nORIGINAL ADVISORY:\nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nOTHER REFERENCES:\nSA33810:\nhttp://secunia.com/advisories/33810/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\nFor more information:\nSA38218\n\nSOLUTION:\nUpdated packages are available via Red Hat Network. iDefense Security Advisory 02.01.10\nhttp://labs.idefense.com/intelligence/vulnerabilities/\nFeb 01, 2010\n\nI. BACKGROUND\n\nRealPlayer is an application for playing various media formats,\ndeveloped by RealNetworks Inc. Since late 2003, Real Player has been\nbased on the open-source Helix Player. More information can be found at\nthe URLs shown. For more information, see the vendor\u0027s site found at the\nfollowing links. \n\nhttp://www.real.com/realplayer.html\nhttp://helixcommunity.org/\n\nII. The vulnerability\noccurs in the CGIFCodec::InitDecompress() function, which does not\nproperly validate a field in the GIF file before using it in an\narithmetic operation that calculates the size of a heap buffer. This\nissue leads to heap corruption, which can result in the execution of\narbitrary code. \n\nIII. An attacker would need\nto entice a victim into opening a RTSP stream. Upon the victim opening\nthe stream, the attack would inject a malformed compressed GIF image\ninto a RTSP stream to exploit this issue. Other attack vectors are\nlikely to exist; however, this was the vector tested within iDefense\nLabs. It should be noted that RealPlayer can be instantiated within a\nWeb browser. This means an attacker could host a malicious Web page and\nentice a victim into visiting this page. Upon visiting the page,\nexploitation would occur. \n\nIV. DETECTION\n\niDefense confirmed RealPlayer version 11 is vulnerable to this issue. WORKAROUND\n\niDefense recommends applying the following workarounds until a patch\nresolving this issue is made publicly available by Real Networks Inc. \nRealPlayer users should change the GIF filetype association to another\napplication. It is also recommended that RealPlayer users disable the\nRealPlayer plugins contained within the Web browsers plugins directory\nby changing the file permissions to deny execution of these files. \nThese workarounds will limit the functionality of RealPlayer by\ndisabling GIF support and web browser plugin features. These\nworkarounds may not mitigate all exploitation vectors but will likely\nprevent the majority of likely scenarios. \n\nVI. VENDOR RESPONSE\n\nRealNetworks has released a patch which addresses this issue. \nInformation about downloadable vendor updates can be found by clicking\non the URLs shown. \n\nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nVII. CVE INFORMATION\n\nThe Common Vulnerabilities and Exposures (CVE) project has assigned the\nname CVE-2009-4245 to this issue. This is a candidate for inclusion in\nthe CVE list (http://cve.mitre.org/), which standardizes names for\nsecurity problems. \n\nVIII. DISCLOSURE TIMELINE\n\n05/13/2008 Initial Contact\n05/03/2008 Initial Response\n02/01/2010 Coordinated public disclosure. \n\nIX. CREDIT\n\nThe discoverer of this vulnerability wishes to remain anonymous. \n\nGet paid for vulnerability research\nhttp://labs.idefense.com/methodology/vulnerability/vcp.php\n\nFree tools, research and upcoming events\nhttp://labs.idefense.com/\n\nX. LEGAL NOTICES\n\nCopyright \\xa9 2010 iDefense, Inc. \n\nPermission is granted for the redistribution of this alert\nelectronically. It may not be edited in any way without the express\nwritten consent of iDefense. If you wish to reprint the whole or any\npart of this alert in any other medium other than electronically,\nplease e-mail customerservice@idefense.com for permission. \n\nDisclaimer: The information in the advisory is believed to be accurate\nat the time of publishing based on currently available information. Use\nof the information constitutes acceptance for use in an AS IS condition. \n There are no warranties with regard to this information. Neither the\nauthor nor the publisher accepts any liability for any direct,\nindirect, or consequential loss or damage arising from use of, or\nreliance on, this information",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4245"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001050"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "VULHUB",
"id": "VHN-41691"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "PACKETSTORM",
"id": "85843"
}
],
"trust": 2.25
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-41691",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41691"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-4245",
"trust": 2.9
},
{
"db": "BID",
"id": "37880",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "38218",
"trust": 2.6
},
{
"db": "SECTRACK",
"id": "1023489",
"trust": 2.5
},
{
"db": "OSVDB",
"id": "61969",
"trust": 2.5
},
{
"db": "VUPEN",
"id": "ADV-2010-0178",
"trust": 2.5
},
{
"db": "XF",
"id": "55800",
"trust": 1.4
},
{
"db": "SECUNIA",
"id": "38450",
"trust": 1.2
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001050",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201001-246",
"trust": 0.7
},
{
"db": "MLIST",
"id": "[DATATYPE-CVS] 20080722 IMAGE/GIF/COMMON GIFCODEC.CPP, 1.6, 1.7 GIFIMAGE.CPP, 1.5, 1.6",
"trust": 0.6
},
{
"db": "REDHAT",
"id": "RHSA-2010:0094",
"trust": 0.6
},
{
"db": "ZDI",
"id": "ZDI-10-010",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-008",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-006",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-005",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-007",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "85843",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-41691",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "85439",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "86184",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41691"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001050"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "PACKETSTORM",
"id": "85843"
},
{
"db": "NVD",
"id": "CVE-2009-4245"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-246"
}
]
},
"id": "VAR-201001-0745",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-41691"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:22:43.293000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/en"
},
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/ja/"
},
{
"title": "RHSA-2010:0094",
"trust": 0.8,
"url": "http://rhn.redhat.com/errata/rhsa-2010-0094.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001050"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41691"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001050"
},
{
"db": "NVD",
"id": "CVE-2009-4245"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/37880"
},
{
"trust": 2.5,
"url": "http://osvdb.org/61969"
},
{
"trust": 2.5,
"url": "http://securitytracker.com/id?1023489"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/38218"
},
{
"trust": 2.5,
"url": "http://www.vupen.com/english/advisories/2010/0178"
},
{
"trust": 2.2,
"url": "http://service.real.com/realplayer/security/01192010_player/en/"
},
{
"trust": 1.7,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=561441"
},
{
"trust": 1.7,
"url": "https://helixcommunity.org/viewcvs/datatype/image/gif/common/gifcodec.cpp?view=log#rev1.7"
},
{
"trust": 1.7,
"url": "https://helixcommunity.org/viewcvs/datatype/image/gif/common/gifimage.cpp?view=log#rev1.6"
},
{
"trust": 1.7,
"url": "https://helixcommunity.org/viewcvs/datatype/image/gif/common/pub/gifcodec.h?view=log#rev1.5"
},
{
"trust": 1.7,
"url": "http://lists.helixcommunity.org/pipermail/datatype-cvs/2008-july/008455.html"
},
{
"trust": 1.7,
"url": "http://www.redhat.com/support/errata/rhsa-2010-0094.html"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/55800"
},
{
"trust": 1.1,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a9998"
},
{
"trust": 1.1,
"url": "http://secunia.com/advisories/38450"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55800"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4245"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-4245"
},
{
"trust": 0.3,
"url": "http://blogs.sun.com/security/entry/cve_2009_4247_buffer_overflow"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=839"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=837"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=838"
},
{
"trust": 0.3,
"url": "http://www.realnetworks.com/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-005/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-006/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-007/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-008/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-010/"
},
{
"trust": 0.3,
"url": "/archive/1/509286"
},
{
"trust": 0.3,
"url": "/archive/1/509293"
},
{
"trust": 0.3,
"url": "/archive/1/509288"
},
{
"trust": 0.3,
"url": "/archive/1/509100"
},
{
"trust": 0.3,
"url": "/archive/1/509096"
},
{
"trust": 0.3,
"url": "/archive/1/509105"
},
{
"trust": 0.3,
"url": "/archive/1/509098"
},
{
"trust": 0.3,
"url": "/archive/1/509104"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/38218/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/blog/71/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33810/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38450/"
},
{
"trust": 0.1,
"url": "http://rhn.redhat.com"
},
{
"trust": 0.1,
"url": "http://rhn.redhat.com/errata/rhsa-2010-0094.html"
},
{
"trust": 0.1,
"url": "http://helixcommunity.org/"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/),"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/"
},
{
"trust": 0.1,
"url": "http://www.real.com/realplayer.html"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/methodology/vulnerability/vcp.php"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-4245"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41691"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001050"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "PACKETSTORM",
"id": "85843"
},
{
"db": "NVD",
"id": "CVE-2009-4245"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-246"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-41691"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001050"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "PACKETSTORM",
"id": "85843"
},
{
"db": "NVD",
"id": "CVE-2009-4245"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-246"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-01-25T00:00:00",
"db": "VULHUB",
"id": "VHN-41691"
},
{
"date": "2010-01-20T00:00:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001050"
},
{
"date": "2010-01-20T16:00:34",
"db": "PACKETSTORM",
"id": "85439"
},
{
"date": "2010-02-11T10:10:16",
"db": "PACKETSTORM",
"id": "86184"
},
{
"date": "2010-02-02T02:25:51",
"db": "PACKETSTORM",
"id": "85843"
},
{
"date": "2010-01-25T19:30:01.433000",
"db": "NVD",
"id": "CVE-2009-4245"
},
{
"date": "2010-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-246"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-19T00:00:00",
"db": "VULHUB",
"id": "VHN-41691"
},
{
"date": "2010-07-13T20:27:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001050"
},
{
"date": "2017-09-19T01:29:56.500000",
"db": "NVD",
"id": "CVE-2009-4245"
},
{
"date": "2011-07-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-246"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "85843"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-246"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Realnetworks RealPlayer Heap-based buffer overflow vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001050"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201001-246"
}
],
"trust": 0.6
}
}
VAR-201001-0740
Vulnerability from variot - Updated: 2023-12-18 12:22RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allow remote attackers to have an unspecified impact via a crafted media file that uses HTTP chunked transfer coding, related to an "overflow.". RealPlayer SP, RealPlayer, and Helix Player are prone to multiple remote vulnerabilities, including heap- and stack-based buffer-overflow issues. A remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Successful exploits will allow the attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. The following are vulnerable: RealPlayer SP 1.0.0 through 1.0.1 RealPlayer 11 11.0.0 through 11.0.5 RealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741 RealPlayer 10 and 10.1 Helix Player 11.0.0 through 11.0.2. This vulnerability is related to \"overflow\". ----------------------------------------------------------------------
Secunia integrated with Microsoft WSUS http://secunia.com/blog/71/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38218
VERIFY ADVISORY: http://secunia.com/advisories/38218/
DESCRIPTION: Some vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a vulnerable system.
1) An unspecified error related to the RealPlayer ASM Rulebook can be exploited to cause a heap-based buffer overflow.
2) An unspecified error when processing GIF images can be exploited to cause a heap-based buffer overflow.
3) A vulnerability is caused due to an unspecified error related to HTTP chunk encoding.
4) An unspecified error within the RealPlayer SIPR codec can be exploited to cause a heap-based buffer overflow.
5) An unspecified error when processing compressed GIF images can be exploited to cause a heap-based buffer overflow.
6) An unspecified error within the RealPlayer SMIL parsing can be exploited to cause a heap-based buffer overflow.
7) An unspecified error within the RealPlayer skin parsing can be exploited to cause a stack-based buffer overflow.
8) An unspecified error related to the RealPlayer ASM RuleBook can be exploited to cause an "array overflow".
9) An unspecified boundary error related to RealPlayer RTSP "set_parameter" can be exploited to cause a buffer overflow.
10) Two vulnerabilities are caused due to errors within the processing of Internet Video Recording (IVR) files. Please see the vendor's advisory for details. http://service.real.com/realplayer/security/01192010_player/en/
PROVIDED AND/OR DISCOVERED BY: The vendor credits: * Evgeny Legerov * anonymous persons working with iDEFENSE Labs * John Rambo and anonymous researchers working with TippingPoint's Zero Day Initiative
ORIGINAL ADVISORY: http://service.real.com/realplayer/security/01192010_player/en/
OTHER REFERENCES: SA33810: http://secunia.com/advisories/33810/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. iDefense Security Advisory 02.01.10 http://labs.idefense.com/intelligence/vulnerabilities/ Feb 01, 2010
I. BACKGROUND
RealPlayer is an application for playing various media formats, developed by RealNetworks Inc. Since late 2003, Real Player has been based on the open-source Helix Player. More information can be found at the URLs shown. For more information, see the vendor's site found at the following link.
http://www.real.com/realplayer.html http://helixcommunity.org/
II.
The vulnerability specifically exists in the handling of the 'chunked' Transfer-Encoding method. This method breaks the file the server is sending into 'chunks'. For each chunk, the server first sends the length of the chunk in hexadecimal, followed by the chunk data. This is repeated until there are no more chunks. The server then sends a chunk length of zero (0) indicating the end of the transfer. When processing these chunks, an integer overflow occurs, which results in a heap overflow. This leads to the execution of arbitrary code.
III. ANALYSIS
Exploitation of this vulnerability results in the execution of arbitrary code with the privileges of the user executing Real Player.
To be successful, an attacker must persuade a user to use Real Player to view specially crafted media. This could be accomplished via a Web page using the RealPlayer plug-in or a direct link to the malicious media.
It appears that the RealPlayer plug-in for Firefox uses the browser to download files via HTTP. The RealPlayer chunked encoding processing is not used in this scenario. However, RealPlayer does provide a right-click context menu to open the document within RealPlayer itself. As such, using Firefox does not prevent exploitation altogether.
IV. DETECTION
iDefense has confirmed the existence of this vulnerability in RealPlayer version 11 on Windows. A nightly build of RealPlayer 10.1.0.3830 for Linux was also confirmed to be vulnerable. Previous versions do not appear be affected.
V. WORKAROUND
iDefense is currently unaware of any workarounds for this issue.
VI. VENDOR RESPONSE
RealNetworks has released a patch which addresses this issue. Information about downloadable vendor updates can be found by clicking on the URLs shown.
http://service.real.com/realplayer/security/01192010_player/en/
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2009-4243 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.
VIII. DISCLOSURE TIMELINE
01/11/2008 Initial Contact 01/11/2009 Initial Response 02/01/2010 Coordinated public disclosure.
IX. CREDIT
The discoverer of this vulnerability wishes to remain anonymous.
Get paid for vulnerability research http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events http://labs.idefense.com/
X. LEGAL NOTICES
Copyright \xa9 2010 iDefense, Inc.
Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201001-0740",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "10.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "*"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "(enterprise)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10.5"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.1"
},
{
"model": "solaris 10 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "solaris 10 sparc",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1741"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1698"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1675"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1663"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1483"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1348"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1235"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1069"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1059"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1056"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1053"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1040"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
}
],
"sources": [
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001046"
},
{
"db": "NVD",
"id": "CVE-2009-4243"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-243"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_enterprise:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4243"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Evgeny Legerov, anonymous researchers working with iDEFENSE Labs, John Rambo, Peter Vreugdenhil working with TippingPoint\u0027s Zero Day Initiative, and anonymous researchers working with TippingPoint\u0027s Zero Day Initiative",
"sources": [
{
"db": "BID",
"id": "37880"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-243"
}
],
"trust": 0.9
},
"cve": "CVE-2009-4243",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2009-4243",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-41689",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2009-4243",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201001-243",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-41689",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41689"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001046"
},
{
"db": "NVD",
"id": "CVE-2009-4243"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-243"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allow remote attackers to have an unspecified impact via a crafted media file that uses HTTP chunked transfer coding, related to an \"overflow.\". RealPlayer SP, RealPlayer, and Helix Player are prone to multiple remote vulnerabilities, including heap- and stack-based buffer-overflow issues. \nA remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Successful exploits will allow the attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. \nThe following are vulnerable:\nRealPlayer SP 1.0.0 through 1.0.1\nRealPlayer 11 11.0.0 through 11.0.5\nRealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741\nRealPlayer 10 and 10.1\nHelix Player 11.0.0 through 11.0.2. This vulnerability is related to \\\"overflow\\\". ----------------------------------------------------------------------\n\n\n\nSecunia integrated with Microsoft WSUS \nhttp://secunia.com/blog/71/\n\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38218\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/38218/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in RealPlayer, which can be\nexploited by malicious people to compromise a vulnerable system. \n\n1) An unspecified error related to the RealPlayer ASM Rulebook can be\nexploited to cause a heap-based buffer overflow. \n\n2) An unspecified error when processing GIF images can be exploited\nto cause a heap-based buffer overflow. \n\n3) A vulnerability is caused due to an unspecified error related to\nHTTP chunk encoding. \n\n4) An unspecified error within the RealPlayer SIPR codec can be\nexploited to cause a heap-based buffer overflow. \n\n5) An unspecified error when processing compressed GIF images can be\nexploited to cause a heap-based buffer overflow. \n\n6) An unspecified error within the RealPlayer SMIL parsing can be\nexploited to cause a heap-based buffer overflow. \n\n7) An unspecified error within the RealPlayer skin parsing can be\nexploited to cause a stack-based buffer overflow. \n\n8) An unspecified error related to the RealPlayer ASM RuleBook can be\nexploited to cause an \"array overflow\". \n\n9) An unspecified boundary error related to RealPlayer RTSP\n\"set_parameter\" can be exploited to cause a buffer overflow. \n\n10) Two vulnerabilities are caused due to errors within the\nprocessing of Internet Video Recording (IVR) files. Please see the vendor\u0027s advisory for\ndetails. \nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits:\n* Evgeny Legerov\n* anonymous persons working with iDEFENSE Labs\n* John Rambo and anonymous researchers working with TippingPoint\u0027s\nZero Day Initiative\n\nORIGINAL ADVISORY:\nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nOTHER REFERENCES:\nSA33810:\nhttp://secunia.com/advisories/33810/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. iDefense Security Advisory 02.01.10\nhttp://labs.idefense.com/intelligence/vulnerabilities/\nFeb 01, 2010\n\nI. BACKGROUND\n\nRealPlayer is an application for playing various media formats,\ndeveloped by RealNetworks Inc. Since late 2003, Real Player has been\nbased on the open-source Helix Player. More information can be found at\nthe URLs shown. For more information, see the vendor\u0027s site found at the\nfollowing link. \n\nhttp://www.real.com/realplayer.html http://helixcommunity.org/\n\nII. \n\nThe vulnerability specifically exists in the handling of the \u0027chunked\u0027\nTransfer-Encoding method. This method breaks the file the server is\nsending into \u0027chunks\u0027. For each chunk, the server first sends the\nlength of the chunk in hexadecimal, followed by the chunk data. This is\nrepeated until there are no more chunks. The server then sends a chunk\nlength of zero (0) indicating the end of the transfer. When processing\nthese chunks, an integer overflow occurs, which results in a heap\noverflow. This leads to the execution of arbitrary code. \n\nIII. ANALYSIS\n\nExploitation of this vulnerability results in the execution of arbitrary\ncode with the privileges of the user executing Real Player. \n\nTo be successful, an attacker must persuade a user to use Real Player to\nview specially crafted media. This could be accomplished via a Web page\nusing the RealPlayer plug-in or a direct link to the malicious media. \n\nIt appears that the RealPlayer plug-in for Firefox uses the browser to\ndownload files via HTTP. The RealPlayer chunked encoding processing is\nnot used in this scenario. However, RealPlayer does provide a\nright-click context menu to open the document within RealPlayer itself. \nAs such, using Firefox does not prevent exploitation altogether. \n\nIV. DETECTION\n\niDefense has confirmed the existence of this vulnerability in RealPlayer\nversion 11 on Windows. A nightly build of RealPlayer 10.1.0.3830 for\nLinux was also confirmed to be vulnerable. Previous versions do not\nappear be affected. \n\nV. WORKAROUND\n\niDefense is currently unaware of any workarounds for this issue. \n\nVI. VENDOR RESPONSE\n\nRealNetworks has released a patch which addresses this issue. \nInformation about downloadable vendor updates can be found by clicking\non the URLs shown. \n\nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nVII. CVE INFORMATION\n\nThe Common Vulnerabilities and Exposures (CVE) project has assigned the\nname CVE-2009-4243 to this issue. This is a candidate for inclusion in\nthe CVE list (http://cve.mitre.org/), which standardizes names for\nsecurity problems. \n\nVIII. DISCLOSURE TIMELINE\n\n01/11/2008 Initial Contact\n01/11/2009 Initial Response\n02/01/2010 Coordinated public disclosure. \n\nIX. CREDIT\n\nThe discoverer of this vulnerability wishes to remain anonymous. \n\nGet paid for vulnerability research\nhttp://labs.idefense.com/methodology/vulnerability/vcp.php\n\nFree tools, research and upcoming events\nhttp://labs.idefense.com/\n\nX. LEGAL NOTICES\n\nCopyright \\xa9 2010 iDefense, Inc. \n\nPermission is granted for the redistribution of this alert\nelectronically. It may not be edited in any way without the express\nwritten consent of iDefense. If you wish to reprint the whole or any\npart of this alert in any other medium other than electronically,\nplease e-mail customerservice@idefense.com for permission. \n\nDisclaimer: The information in the advisory is believed to be accurate\nat the time of publishing based on currently available information. Use\nof the information constitutes acceptance for use in an AS IS condition. \n There are no warranties with regard to this information. Neither the\nauthor nor the publisher accepts any liability for any direct,\nindirect, or consequential loss or damage arising from use of, or\nreliance on, this information",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4243"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001046"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "VULHUB",
"id": "VHN-41689"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85841"
}
],
"trust": 2.16
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-41689",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41689"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-4243",
"trust": 2.9
},
{
"db": "BID",
"id": "37880",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "38218",
"trust": 2.6
},
{
"db": "SECTRACK",
"id": "1023489",
"trust": 2.5
},
{
"db": "OSVDB",
"id": "61967",
"trust": 2.5
},
{
"db": "VUPEN",
"id": "ADV-2010-0178",
"trust": 2.5
},
{
"db": "XF",
"id": "55796",
"trust": 1.4
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001046",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201001-243",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-10-010",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-008",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-006",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-005",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-007",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "85841",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-41689",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "85439",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41689"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001046"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85841"
},
{
"db": "NVD",
"id": "CVE-2009-4243"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-243"
}
]
},
"id": "VAR-201001-0740",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-41689"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:22:42.847000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/en"
},
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/ja/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001046"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41689"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001046"
},
{
"db": "NVD",
"id": "CVE-2009-4243"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/37880"
},
{
"trust": 2.5,
"url": "http://osvdb.org/61967"
},
{
"trust": 2.5,
"url": "http://securitytracker.com/id?1023489"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/38218"
},
{
"trust": 2.5,
"url": "http://www.vupen.com/english/advisories/2010/0178"
},
{
"trust": 2.2,
"url": "http://service.real.com/realplayer/security/01192010_player/en/"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/55796"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55796"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4243"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-4243"
},
{
"trust": 0.3,
"url": "http://blogs.sun.com/security/entry/cve_2009_4247_buffer_overflow"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=839"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=837"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=838"
},
{
"trust": 0.3,
"url": "http://www.realnetworks.com/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-005/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-006/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-007/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-008/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-010/"
},
{
"trust": 0.3,
"url": "/archive/1/509286"
},
{
"trust": 0.3,
"url": "/archive/1/509293"
},
{
"trust": 0.3,
"url": "/archive/1/509288"
},
{
"trust": 0.3,
"url": "/archive/1/509100"
},
{
"trust": 0.3,
"url": "/archive/1/509096"
},
{
"trust": 0.3,
"url": "/archive/1/509105"
},
{
"trust": 0.3,
"url": "/archive/1/509098"
},
{
"trust": 0.3,
"url": "/archive/1/509104"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38218/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/71/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33810/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://helixcommunity.org/"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/),"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/"
},
{
"trust": 0.1,
"url": "http://www.real.com/realplayer.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-4243"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/methodology/vulnerability/vcp.php"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41689"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001046"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85841"
},
{
"db": "NVD",
"id": "CVE-2009-4243"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-243"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-41689"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001046"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85841"
},
{
"db": "NVD",
"id": "CVE-2009-4243"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-243"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-01-25T00:00:00",
"db": "VULHUB",
"id": "VHN-41689"
},
{
"date": "2010-01-20T00:00:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001046"
},
{
"date": "2010-01-20T16:00:34",
"db": "PACKETSTORM",
"id": "85439"
},
{
"date": "2010-02-02T02:24:04",
"db": "PACKETSTORM",
"id": "85841"
},
{
"date": "2010-01-25T19:30:01.370000",
"db": "NVD",
"id": "CVE-2009-4243"
},
{
"date": "2010-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-243"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-17T00:00:00",
"db": "VULHUB",
"id": "VHN-41689"
},
{
"date": "2010-07-13T20:27:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001046"
},
{
"date": "2017-08-17T01:31:30.430000",
"db": "NVD",
"id": "CVE-2009-4243"
},
{
"date": "2010-01-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-243"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "85841"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-243"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Realnetworks RealPlayer In HTTP Vulnerability in Chunk Transfer Coding Processing",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001046"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201001-243"
}
],
"trust": 0.6
}
}
VAR-201001-0743
Vulnerability from variot - Updated: 2023-12-18 12:22Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to execute arbitrary code via a file with invalid ASMRuleBook structures that trigger heap memory corruption. This vulnerability allows remote attackers to execute code on vulnerable installations of RealPlayer. User interaction is required in that a user must open a malicious file or visit a malicious web site.The specific flaw exists during the parsing of files with improperly defined ASMRuleBook structures. A controllable memory allocation allows for an attacker to corrupt heap memory. Attacker controlled data from the corrupt heap is later used as an object pointer which can be leveraged to execute arbitrary code in the context of the currently logged in user. A remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Failed exploit attempts will result in a denial-of-service condition. The following are vulnerable: RealPlayer SP 1.0.0 through 1.0.1 RealPlayer 11 11.0.0 through 11.0.5 RealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741 RealPlayer 10 and 10.1 Helix Player 11.0.0 through 11.0.2. RealPlayer is an online listening tool software that realizes real-time transmission of audio and video through streaming technology on the Internet. ----------------------------------------------------------------------
Secunia integrated with Microsoft WSUS http://secunia.com/blog/71/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38218
VERIFY ADVISORY: http://secunia.com/advisories/38218/
DESCRIPTION: Some vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a vulnerable system.
1) An unspecified error related to the RealPlayer ASM Rulebook can be exploited to cause a heap-based buffer overflow.
2) An unspecified error when processing GIF images can be exploited to cause a heap-based buffer overflow.
3) A vulnerability is caused due to an unspecified error related to HTTP chunk encoding.
4) An unspecified error within the RealPlayer SIPR codec can be exploited to cause a heap-based buffer overflow.
5) An unspecified error when processing compressed GIF images can be exploited to cause a heap-based buffer overflow.
6) An unspecified error within the RealPlayer SMIL parsing can be exploited to cause a heap-based buffer overflow.
7) An unspecified error within the RealPlayer skin parsing can be exploited to cause a stack-based buffer overflow.
8) An unspecified error related to the RealPlayer ASM RuleBook can be exploited to cause an "array overflow".
9) An unspecified boundary error related to RealPlayer RTSP "set_parameter" can be exploited to cause a buffer overflow.
10) Two vulnerabilities are caused due to errors within the processing of Internet Video Recording (IVR) files. Please see the vendor's advisory for details. http://service.real.com/realplayer/security/01192010_player/en/
PROVIDED AND/OR DISCOVERED BY: The vendor credits: * Evgeny Legerov * anonymous persons working with iDEFENSE Labs * John Rambo and anonymous researchers working with TippingPoint's Zero Day Initiative
ORIGINAL ADVISORY: http://service.real.com/realplayer/security/01192010_player/en/
OTHER REFERENCES: SA33810: http://secunia.com/advisories/33810/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. ZDI-10-005: RealNetworks RealPlayer ASMRulebook Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-005 January 21, 2010
-- CVE ID: CVE-2009-4241
-- Affected Vendors: RealNetworks
-- Affected Products: RealNetworks RealPlayer
-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 5783.
-- Vendor Response: RealNetworks has issued an update to correct this vulnerability.
Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201001-0743",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "10.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "*"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "10.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "(enterprise)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10.5"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.1"
},
{
"model": "realplayer",
"scope": null,
"trust": 0.7,
"vendor": "realnetworks",
"version": null
},
{
"model": "solaris 10 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "solaris 10 sparc",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1741"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1698"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1675"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1663"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1483"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1348"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1235"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1069"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1059"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1056"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1053"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1040"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-005"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001044"
},
{
"db": "NVD",
"id": "CVE-2009-4241"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-258"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_enterprise:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4241"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Evgeny Legerov, anonymous researchers working with iDEFENSE Labs, John Rambo, Peter Vreugdenhil working with TippingPoint\u0027s Zero Day Initiative, and anonymous researchers working with TippingPoint\u0027s Zero Day Initiative",
"sources": [
{
"db": "BID",
"id": "37880"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-258"
}
],
"trust": 0.9
},
"cve": "CVE-2009-4241",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2009-4241",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2009-4241",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-41687",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2009-4241",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2009-4241",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201001-258",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-41687",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-005"
},
{
"db": "VULHUB",
"id": "VHN-41687"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001044"
},
{
"db": "NVD",
"id": "CVE-2009-4241"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-258"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to execute arbitrary code via a file with invalid ASMRuleBook structures that trigger heap memory corruption. This vulnerability allows remote attackers to execute code on vulnerable installations of RealPlayer. User interaction is required in that a user must open a malicious file or visit a malicious web site.The specific flaw exists during the parsing of files with improperly defined ASMRuleBook structures. A controllable memory allocation allows for an attacker to corrupt heap memory. Attacker controlled data from the corrupt heap is later used as an object pointer which can be leveraged to execute arbitrary code in the context of the currently logged in user. \nA remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Failed exploit attempts will result in a denial-of-service condition. \nThe following are vulnerable:\nRealPlayer SP 1.0.0 through 1.0.1\nRealPlayer 11 11.0.0 through 11.0.5\nRealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741\nRealPlayer 10 and 10.1\nHelix Player 11.0.0 through 11.0.2. RealPlayer is an online listening tool software that realizes real-time transmission of audio and video through streaming technology on the Internet. ----------------------------------------------------------------------\n\n\n\nSecunia integrated with Microsoft WSUS \nhttp://secunia.com/blog/71/\n\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38218\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/38218/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in RealPlayer, which can be\nexploited by malicious people to compromise a vulnerable system. \n\n1) An unspecified error related to the RealPlayer ASM Rulebook can be\nexploited to cause a heap-based buffer overflow. \n\n2) An unspecified error when processing GIF images can be exploited\nto cause a heap-based buffer overflow. \n\n3) A vulnerability is caused due to an unspecified error related to\nHTTP chunk encoding. \n\n4) An unspecified error within the RealPlayer SIPR codec can be\nexploited to cause a heap-based buffer overflow. \n\n5) An unspecified error when processing compressed GIF images can be\nexploited to cause a heap-based buffer overflow. \n\n6) An unspecified error within the RealPlayer SMIL parsing can be\nexploited to cause a heap-based buffer overflow. \n\n7) An unspecified error within the RealPlayer skin parsing can be\nexploited to cause a stack-based buffer overflow. \n\n8) An unspecified error related to the RealPlayer ASM RuleBook can be\nexploited to cause an \"array overflow\". \n\n9) An unspecified boundary error related to RealPlayer RTSP\n\"set_parameter\" can be exploited to cause a buffer overflow. \n\n10) Two vulnerabilities are caused due to errors within the\nprocessing of Internet Video Recording (IVR) files. Please see the vendor\u0027s advisory for\ndetails. \nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits:\n* Evgeny Legerov\n* anonymous persons working with iDEFENSE Labs\n* John Rambo and anonymous researchers working with TippingPoint\u0027s\nZero Day Initiative\n\nORIGINAL ADVISORY:\nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nOTHER REFERENCES:\nSA33810:\nhttp://secunia.com/advisories/33810/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. ZDI-10-005: RealNetworks RealPlayer ASMRulebook Remote Code Execution Vulnerability\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-005\nJanuary 21, 2010\n\n-- CVE ID:\nCVE-2009-4241\n\n-- Affected Vendors:\nRealNetworks\n\n-- Affected Products:\nRealNetworks RealPlayer\n\n-- TippingPoint(TM) IPS Customer Protection:\nTippingPoint IPS customers have been protected against this\nvulnerability by Digital Vaccine protection filter ID 5783. \n\n-- Vendor Response:\nRealNetworks has issued an update to correct this vulnerability. \n\nResearchers interested in getting paid for their security research\nthrough the ZDI can find more information and sign-up at:\n\n http://www.zerodayinitiative.com\n\nThe ZDI is unique in how the acquired vulnerability information is\nused. TippingPoint does not re-sell the vulnerability details or any\nexploit code. Instead, upon notifying the affected product vendor,\nTippingPoint provides its customers with zero day protection through\nits intrusion prevention technology. Explicit details regarding the\nspecifics of the vulnerability are not exposed to any parties until\nan official vendor patch is publicly available. Furthermore, with the\naltruistic aim of helping to secure a broader user base, TippingPoint\nprovides this vulnerability information confidentially to security\nvendors (including competitors) who have a vulnerability protection or\nmitigation product. \n\nOur vulnerability disclosure policy is available online at:\n\n http://www.zerodayinitiative.com/advisories/disclosure_policy/",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4241"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001044"
},
{
"db": "ZDI",
"id": "ZDI-10-005"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "VULHUB",
"id": "VHN-41687"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85499"
}
],
"trust": 2.79
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-41687",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41687"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-4241",
"trust": 3.6
},
{
"db": "ZDI",
"id": "ZDI-10-005",
"trust": 2.8
},
{
"db": "BID",
"id": "37880",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "38218",
"trust": 2.6
},
{
"db": "SECTRACK",
"id": "1023489",
"trust": 2.5
},
{
"db": "VUPEN",
"id": "ADV-2010-0178",
"trust": 2.5
},
{
"db": "XF",
"id": "55794",
"trust": 1.4
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001044",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-252",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201001-258",
"trust": 0.7
},
{
"db": "BUGTRAQ",
"id": "20100121 ZDI-10-005: REALNETWORKS REALPLAYER ASMRULEBOOK REMOTE CODE EXECUTION VULNERABILITY",
"trust": 0.6
},
{
"db": "ZDI",
"id": "ZDI-10-010",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-008",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-006",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-007",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "85499",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-41687",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "85439",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-005"
},
{
"db": "VULHUB",
"id": "VHN-41687"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001044"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85499"
},
{
"db": "NVD",
"id": "CVE-2009-4241"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-258"
}
]
},
"id": "VAR-201001-0743",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-41687"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:22:42.797000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/en"
},
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/ja/"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5474"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5473"
},
{
"title": "RealPlayerSP",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5472"
},
{
"title": "RealPlayerSPGold",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5471"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001044"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-258"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41687"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001044"
},
{
"db": "NVD",
"id": "CVE-2009-4241"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/37880"
},
{
"trust": 2.5,
"url": "http://securitytracker.com/id?1023489"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/38218"
},
{
"trust": 2.5,
"url": "http://www.vupen.com/english/advisories/2010/0178"
},
{
"trust": 2.2,
"url": "http://service.real.com/realplayer/security/01192010_player/en/"
},
{
"trust": 2.0,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-005/"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/55794"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/509100/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55794"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4241"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-4241"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/509100/100/0/threaded"
},
{
"trust": 0.3,
"url": "http://blogs.sun.com/security/entry/cve_2009_4247_buffer_overflow"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=839"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=837"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=838"
},
{
"trust": 0.3,
"url": "http://www.realnetworks.com/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-006/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-007/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-008/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-010/"
},
{
"trust": 0.3,
"url": "/archive/1/509286"
},
{
"trust": 0.3,
"url": "/archive/1/509293"
},
{
"trust": 0.3,
"url": "/archive/1/509288"
},
{
"trust": 0.3,
"url": "/archive/1/509100"
},
{
"trust": 0.3,
"url": "/archive/1/509096"
},
{
"trust": 0.3,
"url": "/archive/1/509105"
},
{
"trust": 0.3,
"url": "/archive/1/509098"
},
{
"trust": 0.3,
"url": "/archive/1/509104"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38218/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/71/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33810/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/disclosure_policy/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-005"
},
{
"trust": 0.1,
"url": "http://www.tippingpoint.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-4241"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41687"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001044"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85499"
},
{
"db": "NVD",
"id": "CVE-2009-4241"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-258"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-10-005"
},
{
"db": "VULHUB",
"id": "VHN-41687"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001044"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "85499"
},
{
"db": "NVD",
"id": "CVE-2009-4241"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-258"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-01-21T00:00:00",
"db": "ZDI",
"id": "ZDI-10-005"
},
{
"date": "2010-01-25T00:00:00",
"db": "VULHUB",
"id": "VHN-41687"
},
{
"date": "2010-01-20T00:00:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001044"
},
{
"date": "2010-01-20T16:00:34",
"db": "PACKETSTORM",
"id": "85439"
},
{
"date": "2010-01-22T06:34:17",
"db": "PACKETSTORM",
"id": "85499"
},
{
"date": "2010-01-25T19:30:00.980000",
"db": "NVD",
"id": "CVE-2009-4241"
},
{
"date": "2010-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-258"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-07-15T00:00:00",
"db": "ZDI",
"id": "ZDI-10-005"
},
{
"date": "2018-10-10T00:00:00",
"db": "VULHUB",
"id": "VHN-41687"
},
{
"date": "2010-07-13T20:27:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001044"
},
{
"date": "2018-10-10T19:48:49.397000",
"db": "NVD",
"id": "CVE-2009-4241"
},
{
"date": "2010-01-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-258"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "85499"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-258"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Realnetworks RealPlayer Vulnerable to arbitrary code execution",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001044"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201001-258"
}
],
"trust": 0.6
}
}
VAR-201001-0744
Vulnerability from variot - Updated: 2023-12-18 12:22Heap-based buffer overflow in the CGIFCodec::GetPacketBuffer function in datatype/image/gif/common/gifcodec.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via a GIF file with crafted chunk sizes that trigger improper memory allocation. This vulnerability allows remote attackers to execute code on vulnerable installations of RealNetworks RealPlayer. User interaction is required in that a user must open a malicious file or visit a malicious web site.The specific flaw exists during the parsing of GIF files with forged chunk sizes. The player uses values from the file improperly when allocating a buffer on the heap. An attacker can abuse this to create and then overflow heap buffers leading to arbitrary code execution in the context of the currently logged in user. RealPlayer SP, RealPlayer, and Helix Player are prone to multiple remote vulnerabilities, including heap- and stack-based buffer-overflow issues. A remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Failed exploit attempts will result in a denial-of-service condition. The following are vulnerable: RealPlayer SP 1.0.0 through 1.0.1 RealPlayer 11 11.0.0 through 11.0.5 RealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741 RealPlayer 10 and 10.1 Helix Player 11.0.0 through 11.0.2. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. ----------------------------------------------------------------------
Secunia integrated with Microsoft WSUS http://secunia.com/blog/71/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38218
VERIFY ADVISORY: http://secunia.com/advisories/38218/
DESCRIPTION: Some vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a vulnerable system.
1) An unspecified error related to the RealPlayer ASM Rulebook can be exploited to cause a heap-based buffer overflow.
2) An unspecified error when processing GIF images can be exploited to cause a heap-based buffer overflow.
3) A vulnerability is caused due to an unspecified error related to HTTP chunk encoding.
4) An unspecified error within the RealPlayer SIPR codec can be exploited to cause a heap-based buffer overflow.
5) An unspecified error when processing compressed GIF images can be exploited to cause a heap-based buffer overflow.
6) An unspecified error within the RealPlayer SMIL parsing can be exploited to cause a heap-based buffer overflow.
7) An unspecified error within the RealPlayer skin parsing can be exploited to cause a stack-based buffer overflow.
8) An unspecified error related to the RealPlayer ASM RuleBook can be exploited to cause an "array overflow".
9) An unspecified boundary error related to RealPlayer RTSP "set_parameter" can be exploited to cause a buffer overflow.
10) Two vulnerabilities are caused due to errors within the processing of Internet Video Recording (IVR) files. Please see the vendor's advisory for details. http://service.real.com/realplayer/security/01192010_player/en/
PROVIDED AND/OR DISCOVERED BY: The vendor credits: * Evgeny Legerov * anonymous persons working with iDEFENSE Labs * John Rambo and anonymous researchers working with TippingPoint's Zero Day Initiative
ORIGINAL ADVISORY: http://service.real.com/realplayer/security/01192010_player/en/
OTHER REFERENCES: SA33810: http://secunia.com/advisories/33810/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
.
For more information: SA38218
SOLUTION: Updated packages are available via Red Hat Network. ZDI-10-006: RealNetworks RealPlayer GIF Handling Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-006 January 21, 2010
-- CVE ID: CVE-2009-4242
-- Affected Vendors: RealNetworks
-- Affected Products: RealNetworks RealPlayer
-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 0.
-- Vendor Response: RealNetworks has issued an update to correct this vulnerability.
Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201001-0744",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "10.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "11.0.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "*"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "helix player",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "10.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "10.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "(enterprise)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "10.5"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.1"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (es)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.0"
},
{
"model": "realplayer",
"scope": null,
"trust": 0.7,
"vendor": "realnetworks",
"version": null
},
{
"model": "solaris 10 x86",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "solaris 10 sparc",
"scope": null,
"trust": 0.3,
"vendor": "sun",
"version": null
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1741"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1698"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1675"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1663"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1483"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1348"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1235"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1069"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1059"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1056"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1053"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10.5v6.0.12.1040"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-006"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001045"
},
{
"db": "NVD",
"id": "CVE-2009-4242"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-259"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_enterprise:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:10.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:helix_player:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.0:*:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4242"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Evgeny Legerov, anonymous researchers working with iDEFENSE Labs, John Rambo, Peter Vreugdenhil working with TippingPoint\u0027s Zero Day Initiative, and anonymous researchers working with TippingPoint\u0027s Zero Day Initiative",
"sources": [
{
"db": "BID",
"id": "37880"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-259"
}
],
"trust": 0.9
},
"cve": "CVE-2009-4242",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2009-4242",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2009-4242",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-41688",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2009-4242",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2009-4242",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201001-259",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-41688",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-006"
},
{
"db": "VULHUB",
"id": "VHN-41688"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001045"
},
{
"db": "NVD",
"id": "CVE-2009-4242"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-259"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in the CGIFCodec::GetPacketBuffer function in datatype/image/gif/common/gifcodec.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via a GIF file with crafted chunk sizes that trigger improper memory allocation. This vulnerability allows remote attackers to execute code on vulnerable installations of RealNetworks RealPlayer. User interaction is required in that a user must open a malicious file or visit a malicious web site.The specific flaw exists during the parsing of GIF files with forged chunk sizes. The player uses values from the file improperly when allocating a buffer on the heap. An attacker can abuse this to create and then overflow heap buffers leading to arbitrary code execution in the context of the currently logged in user. RealPlayer SP, RealPlayer, and Helix Player are prone to multiple remote vulnerabilities, including heap- and stack-based buffer-overflow issues. \nA remote attacker could exploit these issues by crafting a file and enticing an unsuspecting user to open it using a vulnerable application. Failed exploit attempts will result in a denial-of-service condition. \nThe following are vulnerable:\nRealPlayer SP 1.0.0 through 1.0.1\nRealPlayer 11 11.0.0 through 11.0.5\nRealPlayer 10.5 6.0.12.1040 through 6.0.12.163, 6.0.12.1675, 6.0.12.1698, and 6.0.12.1741\nRealPlayer 10 and 10.1\nHelix Player 11.0.0 through 11.0.2. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. ----------------------------------------------------------------------\n\n\n\nSecunia integrated with Microsoft WSUS \nhttp://secunia.com/blog/71/\n\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38218\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/38218/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in RealPlayer, which can be\nexploited by malicious people to compromise a vulnerable system. \n\n1) An unspecified error related to the RealPlayer ASM Rulebook can be\nexploited to cause a heap-based buffer overflow. \n\n2) An unspecified error when processing GIF images can be exploited\nto cause a heap-based buffer overflow. \n\n3) A vulnerability is caused due to an unspecified error related to\nHTTP chunk encoding. \n\n4) An unspecified error within the RealPlayer SIPR codec can be\nexploited to cause a heap-based buffer overflow. \n\n5) An unspecified error when processing compressed GIF images can be\nexploited to cause a heap-based buffer overflow. \n\n6) An unspecified error within the RealPlayer SMIL parsing can be\nexploited to cause a heap-based buffer overflow. \n\n7) An unspecified error within the RealPlayer skin parsing can be\nexploited to cause a stack-based buffer overflow. \n\n8) An unspecified error related to the RealPlayer ASM RuleBook can be\nexploited to cause an \"array overflow\". \n\n9) An unspecified boundary error related to RealPlayer RTSP\n\"set_parameter\" can be exploited to cause a buffer overflow. \n\n10) Two vulnerabilities are caused due to errors within the\nprocessing of Internet Video Recording (IVR) files. Please see the vendor\u0027s advisory for\ndetails. \nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits:\n* Evgeny Legerov\n* anonymous persons working with iDEFENSE Labs\n* John Rambo and anonymous researchers working with TippingPoint\u0027s\nZero Day Initiative\n\nORIGINAL ADVISORY:\nhttp://service.real.com/realplayer/security/01192010_player/en/\n\nOTHER REFERENCES:\nSA33810:\nhttp://secunia.com/advisories/33810/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\nFor more information:\nSA38218\n\nSOLUTION:\nUpdated packages are available via Red Hat Network. ZDI-10-006: RealNetworks RealPlayer GIF Handling Remote Code Execution Vulnerability\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-006\nJanuary 21, 2010\n\n-- CVE ID:\nCVE-2009-4242\n\n-- Affected Vendors:\nRealNetworks\n\n-- Affected Products:\nRealNetworks RealPlayer\n\n-- TippingPoint(TM) IPS Customer Protection:\nTippingPoint IPS customers have been protected against this\nvulnerability by Digital Vaccine protection filter ID 0. \n\n-- Vendor Response:\nRealNetworks has issued an update to correct this vulnerability. \n\nResearchers interested in getting paid for their security research\nthrough the ZDI can find more information and sign-up at:\n\n http://www.zerodayinitiative.com\n\nThe ZDI is unique in how the acquired vulnerability information is\nused. TippingPoint does not re-sell the vulnerability details or any\nexploit code. Instead, upon notifying the affected product vendor,\nTippingPoint provides its customers with zero day protection through\nits intrusion prevention technology. Explicit details regarding the\nspecifics of the vulnerability are not exposed to any parties until\nan official vendor patch is publicly available. Furthermore, with the\naltruistic aim of helping to secure a broader user base, TippingPoint\nprovides this vulnerability information confidentially to security\nvendors (including competitors) who have a vulnerability protection or\nmitigation product. \n\nOur vulnerability disclosure policy is available online at:\n\n http://www.zerodayinitiative.com/advisories/disclosure_policy/",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-4242"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001045"
},
{
"db": "ZDI",
"id": "ZDI-10-006"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "VULHUB",
"id": "VHN-41688"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "PACKETSTORM",
"id": "85503"
}
],
"trust": 2.88
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-41688",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41688"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-4242",
"trust": 3.6
},
{
"db": "ZDI",
"id": "ZDI-10-006",
"trust": 2.8
},
{
"db": "BID",
"id": "37880",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "38218",
"trust": 2.6
},
{
"db": "SECTRACK",
"id": "1023489",
"trust": 2.5
},
{
"db": "OSVDB",
"id": "61966",
"trust": 2.5
},
{
"db": "VUPEN",
"id": "ADV-2010-0178",
"trust": 2.5
},
{
"db": "XF",
"id": "55795",
"trust": 1.4
},
{
"db": "SECUNIA",
"id": "38450",
"trust": 1.2
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001045",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-271",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201001-259",
"trust": 0.7
},
{
"db": "BUGTRAQ",
"id": "20100121 ZDI-10-006: REALNETWORKS REALPLAYER GIF HANDLING REMOTE CODE EXECUTION VULNERABILITY",
"trust": 0.6
},
{
"db": "MLIST",
"id": "[DATATYPE-CVS] 20080909 IMAGE/GIF/COMMON GIFCODEC.CPP,1.7,1.8",
"trust": 0.6
},
{
"db": "REDHAT",
"id": "RHSA-2010:0094",
"trust": 0.6
},
{
"db": "ZDI",
"id": "ZDI-10-010",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-008",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-005",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-10-007",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "85503",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-41688",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "85439",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "86184",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-006"
},
{
"db": "VULHUB",
"id": "VHN-41688"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001045"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "PACKETSTORM",
"id": "85503"
},
{
"db": "NVD",
"id": "CVE-2009-4242"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-259"
}
]
},
"id": "VAR-201001-0744",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-41688"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:22:42.896000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/ja/"
},
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/01192010_player/en"
},
{
"title": "RHSA-2010:0094",
"trust": 0.8,
"url": "http://rhn.redhat.com/errata/rhsa-2010-0094.html"
},
{
"title": "RealNetworks has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "http://service.real.com/realplayer/security/01192010_player/en/"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5474"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5473"
},
{
"title": "RealPlayerSP",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5472"
},
{
"title": "RealPlayerSPGold",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=5471"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-006"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001045"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-259"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-41688"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001045"
},
{
"db": "NVD",
"id": "CVE-2009-4242"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.9,
"url": "http://service.real.com/realplayer/security/01192010_player/en/"
},
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/37880"
},
{
"trust": 2.5,
"url": "http://osvdb.org/61966"
},
{
"trust": 2.5,
"url": "http://securitytracker.com/id?1023489"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/38218"
},
{
"trust": 2.5,
"url": "http://www.vupen.com/english/advisories/2010/0178"
},
{
"trust": 2.0,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-006/"
},
{
"trust": 1.7,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=561436"
},
{
"trust": 1.7,
"url": "https://helixcommunity.org/viewcvs/datatype/image/gif/common/gifcodec.cpp?view=log#rev1.8"
},
{
"trust": 1.7,
"url": "http://lists.helixcommunity.org/pipermail/datatype-cvs/2008-september/008633.html"
},
{
"trust": 1.7,
"url": "http://www.redhat.com/support/errata/rhsa-2010-0094.html"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/55795"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/509096/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a10144"
},
{
"trust": 1.1,
"url": "http://secunia.com/advisories/38450"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/55795"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4242"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-4242"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/509096/100/0/threaded"
},
{
"trust": 0.3,
"url": "http://blogs.sun.com/security/entry/cve_2009_4247_buffer_overflow"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=839"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=837"
},
{
"trust": 0.3,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=838"
},
{
"trust": 0.3,
"url": "http://www.realnetworks.com/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-005/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-007/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-008/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-010/"
},
{
"trust": 0.3,
"url": "/archive/1/509286"
},
{
"trust": 0.3,
"url": "/archive/1/509293"
},
{
"trust": 0.3,
"url": "/archive/1/509288"
},
{
"trust": 0.3,
"url": "/archive/1/509100"
},
{
"trust": 0.3,
"url": "/archive/1/509096"
},
{
"trust": 0.3,
"url": "/archive/1/509105"
},
{
"trust": 0.3,
"url": "/archive/1/509098"
},
{
"trust": 0.3,
"url": "/archive/1/509104"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/38218/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/blog/71/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33810/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38450/"
},
{
"trust": 0.1,
"url": "http://rhn.redhat.com"
},
{
"trust": 0.1,
"url": "http://rhn.redhat.com/errata/rhsa-2010-0094.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/disclosure_policy/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-006"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-4242"
},
{
"trust": 0.1,
"url": "http://www.tippingpoint.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-006"
},
{
"db": "VULHUB",
"id": "VHN-41688"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001045"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "PACKETSTORM",
"id": "85503"
},
{
"db": "NVD",
"id": "CVE-2009-4242"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-259"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-10-006"
},
{
"db": "VULHUB",
"id": "VHN-41688"
},
{
"db": "BID",
"id": "37880"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-001045"
},
{
"db": "PACKETSTORM",
"id": "85439"
},
{
"db": "PACKETSTORM",
"id": "86184"
},
{
"db": "PACKETSTORM",
"id": "85503"
},
{
"db": "NVD",
"id": "CVE-2009-4242"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-259"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-01-21T00:00:00",
"db": "ZDI",
"id": "ZDI-10-006"
},
{
"date": "2010-01-25T00:00:00",
"db": "VULHUB",
"id": "VHN-41688"
},
{
"date": "2010-01-20T00:00:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001045"
},
{
"date": "2010-01-20T16:00:34",
"db": "PACKETSTORM",
"id": "85439"
},
{
"date": "2010-02-11T10:10:16",
"db": "PACKETSTORM",
"id": "86184"
},
{
"date": "2010-01-22T07:20:58",
"db": "PACKETSTORM",
"id": "85503"
},
{
"date": "2010-01-25T19:30:01.090000",
"db": "NVD",
"id": "CVE-2009-4242"
},
{
"date": "2010-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-259"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-01-21T00:00:00",
"db": "ZDI",
"id": "ZDI-10-006"
},
{
"date": "2018-10-10T00:00:00",
"db": "VULHUB",
"id": "VHN-41688"
},
{
"date": "2010-07-13T20:27:00",
"db": "BID",
"id": "37880"
},
{
"date": "2010-02-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-001045"
},
{
"date": "2018-10-10T19:48:50.383000",
"db": "NVD",
"id": "CVE-2009-4242"
},
{
"date": "2011-07-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201001-259"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "85503"
},
{
"db": "CNNVD",
"id": "CNNVD-201001-259"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Realnetworks RealPlayer Vulnerabilities in arbitrary code execution",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-001045"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201001-259"
}
],
"trust": 0.6
}
}
VAR-201012-0248
Vulnerability from variot - Updated: 2023-12-18 12:10The RealAudio codec in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, Mac RealPlayer 11.0 through 12.0.0.1444, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted audio stream in a RealMedia file. Real Networks RealPlayer is prone to a memory-corruption vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition. This issue affects Windows RealPlayer SP 1.1.4 and prior, Mac RealPlayer 12.0.0.1379 and prior, and Linux RealPlayer 11.0.2.1744 and prior. NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial: http://secunia.com/products/corporate/vim/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38550
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/38550/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
RELEASE DATE: 2010-12-12
DISCUSS ADVISORY: http://secunia.com/advisories/38550/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/38550/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system.
1) An error exists when parsing RealAudio content encoded using the "cook" codec. This can be exploited to trigger the use of uninitialised memory and potentially cause a memory corruption via e.g. a specially crafted RealMedia file.
2) An error in the handling of errors encountered while decoding "cook"-encoded audio content can be exploited to trigger the use of uninitialised memory and potentially free an arbitrary address.
3) An error in the parsing of AAC audio content can be exploited to corrupt memory via specially crafted spectral data.
4) An array indexing error when parsing Media Properties Header (MDPR) in a RealMedia file can be exploited to corrupt memory.
5) An input validation error when parsing a RealMedia file can be exploited to cause a buffer overflow via a specially crafted multi-rate audio stream.
6) An error in the processing of the "StreamTitle" tag in a SHOUTcast stream using the ICY protocol can be exploited to cause an allocation failure for heap memory, which can result in the usage of freed pointers.
7) An integer overflow error when parsing a MLLT atom in an .AAC file can be exploited to cause a buffer overflow.
8) An input validation error in the "pnen3260.dll" module in the parsing of TIT2 atoms within AAC files can be exploited to corrupt memory.
9) An integer overflow in the parsing of GIF87a files over the streaming protocol RTSP can be exploited to cause a buffer overflow via a large "Screen Width" size in the "Screen Descriptor" header.
10) An error in the parsing of audio codec information in a Real Audio media file can be exploited to to cause a heap-based buffer overflow via a large number of subbands.
11) An input validation error in drv2.dll when decompressing RV20 video streams can be exploited to corrupt heap memory.
12) An unspecified error related to "SIPR" parsing can be exploited to corrupt heap memory.
13) An unspecified error related to "SOUND" processing can be exploited to corrupt heap memory.
14) An unspecified error related to "AAC" processing can be exploited to corrupt heap memory.
15) An unspecified error related to "RealMedia" processing can be exploited to corrupt heap memory.
16) An unspecified error related to "RA5" processing can be exploited to corrupt heap memory.
17) An integer overflow in "drv1.dll" when parsing SIPR stream metadata can be exploited to cause a heap-based buffer overflow, e.g. via the RealPlayer ActiveX control.
18) An input validation error in the processing of RealMedia files can be exploited to corrupt heap memory.
19) An input validation error in the RealAudio codec when processing RealMedia files can be exploited to corrupt heap memory.
20) An error in the "HandleAction" method in the RealPlayer ActiveX control allows users to download and execute scripts in the "Local Zone".
21) Input sanitisation errors in the "Custsupport.html", "Main.html", and "Upsell.htm" components can be exploited to inject arbitrary code into the RealOneActiveXObject process and load unsafe controls.
22) A boundary error in the parsing of cook-specific data used for initialization can be exploited to cause a heap-based buffer overflow.
23) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to cause a heap-based buffer overflow via an invalid size for an embedded MDPR chunk.
24) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to corrupt heap memory via an invalid number streams within the chunk.
25) An input validation error when parsing the RMX file format can be exploited to cause a heap-based buffer overflow.
26) An error when decoding data for particular mime types within a RealMedia file can be exploited to cause a heap-based buffer overflow.
27) An error in the parsing of server headers can be exploited to cause a heap-based buffer overflow via an image tag pointing to a malicious server, which causes the player to fetch a remote file.
28) An error in the implementation of the Advanced Audio Coding compression when decoding a conditional component of a data block within an AAC frame can be exploited to corrupt memory.
SOLUTION: Upgrade to RealPlayer 14.0.0 or later.
PROVIDED AND/OR DISCOVERED BY: 1, 2) Alin Rad Pop, Secunia Research. 3) Carsten Eiram, Secunia Research. 4) Anonymous and Hossein Lotfi, reported via ZDI. 5 - 11, 20, 21) Anonymous, reported via ZDI. 12 - 14) The vendor credits Nicolas Joly, Vupen 15) The vendor credits Chaouki Bekrar, Vupen 17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs 18, 19) Omair, reported via iDefense. 22, 28) Damian Put, reported via ZDI. 23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team lollersk8erz. 25) Sebastian Apelt, reported via ZDI. 26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. 27) AbdulAziz Hariri, reported via ZDI.
ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2010-9/ http://secunia.com/secunia_research/2010-14/ http://secunia.com/secunia_research/2010-15/
RealNetworks: http://service.real.com/realplayer/security/12102010_player/en/ http://realnetworksblog.com/?p=2216
ZDI: http://www.zerodayinitiative.com/advisories/ZDI-10-268/ http://www.zerodayinitiative.com/advisories/ZDI-10-266/ http://www.zerodayinitiative.com/advisories/ZDI-10-270/ http://www.zerodayinitiative.com/advisories/ZDI-10-273/ http://www.zerodayinitiative.com/advisories/ZDI-10-269/ http://www.zerodayinitiative.com/advisories/ZDI-10-271/ http://www.zerodayinitiative.com/advisories/ZDI-10-272/ http://www.zerodayinitiative.com/advisories/ZDI-10-274/ http://www.zerodayinitiative.com/advisories/ZDI-10-275/ http://www.zerodayinitiative.com/advisories/ZDI-10-276/ http://www.zerodayinitiative.com/advisories/ZDI-10-277/ http://www.zerodayinitiative.com/advisories/ZDI-10-278/ http://www.zerodayinitiative.com/advisories/ZDI-10-279/ http://www.zerodayinitiative.com/advisories/ZDI-10-281/ http://www.zerodayinitiative.com/advisories/ZDI-10-280/ http://www.zerodayinitiative.com/advisories/ZDI-10-282/ http://www.zerodayinitiative.com/advisories/ZDI-10-267/
TippingPoint DVLabs: http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html
iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. BACKGROUND
RealPlayer is RealNetworks's media player product used to render video and other media. For more information, visit http://www.real.com/.
II.
The vulnerability specifically exists in the way RealPlayer handles specially crafted RealMedia files using RealAudio codec.
III. To exploit this vulnerability, an attacker must persuade a victim into using RealPlayer to open a specially crafted media file. This could be accomplished by either direct link or referenced from a website under the attacker's control. An attacker could host a Web page containing a malformed file. Alternatively a malicious media file could be attached within an e-mail file.
IV.
V. WORKAROUND
iDefense is currently unaware of any workaround for this issue.
VI. VENDOR RESPONSE
RealNetworks has released a patch which addresses this issue. Information about downloadable vendor updates can be found by clicking on the URLs shown.
http://service.real.com/realplayer/security/12102010_player/en/
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2010-4387 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.
VIII. DISCLOSURE TIMELINE
05/12/2010 Initial Contact 05/12/2010 Initial Response 12/10/2010 Coordinated public disclosure
IX.
Get paid for vulnerability research http://labs.idefense.com/methodology/vulnerability/vcp.php
Free tools, research and upcoming events http://labs.idefense.com/
X. LEGAL NOTICES
Copyright \xa9 2010 iDefense, Inc.
Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201012-0248",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "1.1.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1.3"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0.2.1744 (linux)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "12.0.0.1444 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0 to 1.0.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.2 to 1.1.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.1.2 to 1.1.4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for mac",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "12.0.0.1548"
},
{
"model": "realplayer for linux",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.0.2.2315"
},
{
"model": "realplayer",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "14.0.1"
}
],
"sources": [
{
"db": "BID",
"id": "45453"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002600"
},
{
"db": "NVD",
"id": "CVE-2010-4387"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-177"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:12.0.0.1444:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4387"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Omair",
"sources": [
{
"db": "BID",
"id": "45453"
}
],
"trust": 0.3
},
"cve": "CVE-2010-4387",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-4387",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-46992",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-4387",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201012-177",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-46992",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46992"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002600"
},
{
"db": "NVD",
"id": "CVE-2010-4387"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-177"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The RealAudio codec in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, Mac RealPlayer 11.0 through 12.0.0.1444, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted audio stream in a RealMedia file. Real Networks RealPlayer is prone to a memory-corruption vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. \nSuccessfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition. \nThis issue affects Windows RealPlayer SP 1.1.4 and prior, Mac RealPlayer 12.0.0.1379 and prior, and Linux RealPlayer 11.0.2.1744 and prior. \nNOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nRequest a free trial: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38550\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/38550/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nRELEASE DATE:\n2010-12-12\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/38550/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/38550/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in RealPlayer, which can\nbe exploited by malicious people to compromise a user\u0027s system. \n\n1) An error exists when parsing RealAudio content encoded using the\n\"cook\" codec. This can be exploited to trigger the use of\nuninitialised memory and potentially cause a memory corruption via\ne.g. a specially crafted RealMedia file. \n\n2) An error in the handling of errors encountered while decoding\n\"cook\"-encoded audio content can be exploited to trigger the use of\nuninitialised memory and potentially free an arbitrary address. \n\n3) An error in the parsing of AAC audio content can be exploited to\ncorrupt memory via specially crafted spectral data. \n\n4) An array indexing error when parsing Media Properties Header\n(MDPR) in a RealMedia file can be exploited to corrupt memory. \n\n5) An input validation error when parsing a RealMedia file can be\nexploited to cause a buffer overflow via a specially crafted\nmulti-rate audio stream. \n\n6) An error in the processing of the \"StreamTitle\" tag in a SHOUTcast\nstream using the ICY protocol can be exploited to cause an allocation\nfailure for heap memory, which can result in the usage of freed\npointers. \n\n7) An integer overflow error when parsing a MLLT atom in an .AAC file\ncan be exploited to cause a buffer overflow. \n\n8) An input validation error in the \"pnen3260.dll\" module in the\nparsing of TIT2 atoms within AAC files can be exploited to corrupt\nmemory. \n\n9) An integer overflow in the parsing of GIF87a files over the\nstreaming protocol RTSP can be exploited to cause a buffer overflow\nvia a large \"Screen Width\" size in the \"Screen Descriptor\" header. \n\n10) An error in the parsing of audio codec information in a Real\nAudio media file can be exploited to to cause a heap-based buffer\noverflow via a large number of subbands. \n\n11) An input validation error in drv2.dll when decompressing RV20\nvideo streams can be exploited to corrupt heap memory. \n\n12) An unspecified error related to \"SIPR\" parsing can be exploited\nto corrupt heap memory. \n\n13) An unspecified error related to \"SOUND\" processing can be\nexploited to corrupt heap memory. \n\n14) An unspecified error related to \"AAC\" processing can be exploited\nto corrupt heap memory. \n\n15) An unspecified error related to \"RealMedia\" processing can be\nexploited to corrupt heap memory. \n\n16) An unspecified error related to \"RA5\" processing can be exploited\nto corrupt heap memory. \n\n17) An integer overflow in \"drv1.dll\" when parsing SIPR stream\nmetadata can be exploited to cause a heap-based buffer overflow, e.g. \nvia the RealPlayer ActiveX control. \n\n18) An input validation error in the processing of RealMedia files\ncan be exploited to corrupt heap memory. \n\n19) An input validation error in the RealAudio codec when processing\nRealMedia files can be exploited to corrupt heap memory. \n\n20) An error in the \"HandleAction\" method in the RealPlayer ActiveX\ncontrol allows users to download and execute scripts in the \"Local\nZone\". \n\n21) Input sanitisation errors in the \"Custsupport.html\", \"Main.html\",\nand \"Upsell.htm\" components can be exploited to inject arbitrary code\ninto the RealOneActiveXObject process and load unsafe controls. \n\n22) A boundary error in the parsing of cook-specific data used for\ninitialization can be exploited to cause a heap-based buffer\noverflow. \n\n23) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to cause a heap-based\nbuffer overflow via an invalid size for an embedded MDPR chunk. \n\n24) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to corrupt heap memory\nvia an invalid number streams within the chunk. \n\n25) An input validation error when parsing the RMX file format can be\nexploited to cause a heap-based buffer overflow. \n\n26) An error when decoding data for particular mime types within a\nRealMedia file can be exploited to cause a heap-based buffer\noverflow. \n\n27) An error in the parsing of server headers can be exploited to\ncause a heap-based buffer overflow via an image tag pointing to a\nmalicious server, which causes the player to fetch a remote file. \n\n28) An error in the implementation of the Advanced Audio Coding\ncompression when decoding a conditional component of a data block\nwithin an AAC frame can be exploited to corrupt memory. \n\nSOLUTION:\nUpgrade to RealPlayer 14.0.0 or later. \n\nPROVIDED AND/OR DISCOVERED BY:\n1, 2) Alin Rad Pop, Secunia Research. \n3) Carsten Eiram, Secunia Research. \n4) Anonymous and Hossein Lotfi, reported via ZDI. \n5 - 11, 20, 21) Anonymous, reported via ZDI. \n12 - 14) The vendor credits Nicolas Joly, Vupen\n15) The vendor credits Chaouki Bekrar, Vupen\n17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs\n18, 19) Omair, reported via iDefense. \n22, 28) Damian Put, reported via ZDI. \n23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team\nlollersk8erz. \n25) Sebastian Apelt, reported via ZDI. \n26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. \n27) AbdulAziz Hariri, reported via ZDI. \n\nORIGINAL ADVISORY:\nSecunia Research:\nhttp://secunia.com/secunia_research/2010-9/\nhttp://secunia.com/secunia_research/2010-14/\nhttp://secunia.com/secunia_research/2010-15/\n\nRealNetworks:\nhttp://service.real.com/realplayer/security/12102010_player/en/\nhttp://realnetworksblog.com/?p=2216\n\nZDI:\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-268/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-266/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-270/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-273/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-269/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-271/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-272/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-274/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-275/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-276/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-277/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-278/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-279/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-281/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-280/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-282/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-267/\n\nTippingPoint DVLabs:\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html\n\niDefense Labs:\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. BACKGROUND\n\nRealPlayer is RealNetworks\u0027s media player product used to render video\nand other media. For more information, visit http://www.real.com/. \n\nII. \n\nThe vulnerability specifically exists in the way RealPlayer handles\nspecially crafted RealMedia files using RealAudio codec. \n\nIII. To exploit this\nvulnerability, an attacker must persuade a victim into using RealPlayer\nto open a specially crafted media file. This could be accomplished by\neither direct link or referenced from a website under the attacker\u0027s\ncontrol. An attacker could host a Web page containing a malformed file. Alternatively a\nmalicious media file could be attached within an e-mail file. \n\nIV. \n\nV. WORKAROUND\n\niDefense is currently unaware of any workaround for this issue. \n\nVI. VENDOR RESPONSE\n\nRealNetworks has released a patch which addresses this issue. \nInformation about downloadable vendor updates can be found by clicking\non the URLs shown. \n\nhttp://service.real.com/realplayer/security/12102010_player/en/\n\nVII. CVE INFORMATION\n\nThe Common Vulnerabilities and Exposures (CVE) project has assigned the\nname CVE-2010-4387 to this issue. This is a candidate for inclusion in\nthe CVE list (http://cve.mitre.org/), which standardizes names for\nsecurity problems. \n\nVIII. DISCLOSURE TIMELINE\n\n05/12/2010 Initial Contact\n05/12/2010 Initial Response\n12/10/2010 Coordinated public disclosure\n\nIX. \n\nGet paid for vulnerability research\nhttp://labs.idefense.com/methodology/vulnerability/vcp.php\n\nFree tools, research and upcoming events\nhttp://labs.idefense.com/\n\nX. LEGAL NOTICES\n\nCopyright \\xa9 2010 iDefense, Inc. \n\nPermission is granted for the redistribution of this alert\nelectronically. It may not be edited in any way without the express\nwritten consent of iDefense. If you wish to reprint the whole or any\npart of this alert in any other medium other than electronically,\nplease e-mail customerservice@idefense.com for permission. \n\nDisclaimer: The information in the advisory is believed to be accurate\nat the time of publishing based on currently available information. Use\nof the information constitutes acceptance for use in an AS IS condition. \n There are no warranties with regard to this information. Neither the\nauthor nor the publisher accepts any liability for any direct,\nindirect, or consequential loss or damage arising from use of, or\nreliance on, this information",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4387"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002600"
},
{
"db": "BID",
"id": "45453"
},
{
"db": "VULHUB",
"id": "VHN-46992"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96656"
},
{
"db": "PACKETSTORM",
"id": "96637"
}
],
"trust": 2.34
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-46992",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46992"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-4387",
"trust": 2.9
},
{
"db": "SECUNIA",
"id": "38550",
"trust": 1.6
},
{
"db": "SECTRACK",
"id": "1024861",
"trust": 1.1
},
{
"db": "VUPEN",
"id": "ADV-2010-3190",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002600",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201012-177",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "42512",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "42565",
"trust": 0.7
},
{
"db": "IDEFENSE",
"id": "20101210 REALNETWORKS REALPLAYER REALAUDIO CODEC MEMORY CORRUPTION VULNERABILITY",
"trust": 0.6
},
{
"db": "BID",
"id": "45453",
"trust": 0.4
},
{
"db": "PACKETSTORM",
"id": "96656",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-46992",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-268",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-273",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-272",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-267",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-276",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-269",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-280",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-282",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-278",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-277",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-271",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-274",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-266",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-281",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-279",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-270",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-275",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96640",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96637",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46992"
},
{
"db": "BID",
"id": "45453"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002600"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96656"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4387"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-177"
}
]
},
"id": "VAR-201012-0248",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-46992"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:10:59.407000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/ja"
},
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/en"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002600"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46992"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002600"
},
{
"db": "NVD",
"id": "CVE-2010-4387"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"trust": 1.8,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/38550"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id?1024861"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4387"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-4387"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2010/3190"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/42565"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/42512"
},
{
"trust": 0.4,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883"
},
{
"trust": 0.3,
"url": "http://realnetworksblog.com/?p=2192"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/blog/2010/12/09/realnetworks-patches-27-vulnerabilities"
},
{
"trust": 0.3,
"url": "http://www.real.com/"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.3,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.3,
"url": "http://realnetworksblog.com/?p=2216"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-14/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-15/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-9/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/#comments"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42512/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42512"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42512/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-4387"
},
{
"trust": 0.1,
"url": "http://www.real.com/."
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/),"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/methodology/vulnerability/vcp.php"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42565"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46992"
},
{
"db": "BID",
"id": "45453"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002600"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96656"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4387"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-177"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-46992"
},
{
"db": "BID",
"id": "45453"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002600"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96656"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4387"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-177"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-14T00:00:00",
"db": "VULHUB",
"id": "VHN-46992"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45453"
},
{
"date": "2011-01-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002600"
},
{
"date": "2010-12-13T04:13:47",
"db": "PACKETSTORM",
"id": "96636"
},
{
"date": "2010-12-13T04:13:58",
"db": "PACKETSTORM",
"id": "96640"
},
{
"date": "2010-12-13T17:12:12",
"db": "PACKETSTORM",
"id": "96656"
},
{
"date": "2010-12-13T04:13:50",
"db": "PACKETSTORM",
"id": "96637"
},
{
"date": "2010-12-14T16:00:04.837000",
"db": "NVD",
"id": "CVE-2010-4387"
},
{
"date": "2010-12-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-177"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-01-19T00:00:00",
"db": "VULHUB",
"id": "VHN-46992"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45453"
},
{
"date": "2011-01-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002600"
},
{
"date": "2011-01-19T07:02:15.363000",
"db": "NVD",
"id": "CVE-2010-4387"
},
{
"date": "2010-12-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-177"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "96656"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-177"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer of RealAudio Vulnerability in arbitrary code execution in codec",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002600"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-177"
}
],
"trust": 0.6
}
}
VAR-201012-0224
Vulnerability from variot - Updated: 2023-12-18 12:10Integer overflow in the pnen3260.dll module in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code via a crafted TIT2 atom in an AAC file. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists in RealPlayer's pnen3260.dll module while parsing the TIT2 atom within AAC files. The code within this module does not account for a negative size during an allocation and later uses the value as unsigned within a copy loop. Real Networks RealPlayer is prone to an integer-overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. ZDI-10-269: RealNetworks RealPlayer AAC TIT2 Atom Integer Overflow Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-10-269
December 10, 2010
-- CVE ID: CVE-2010-4397
-- CVSS: 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)
-- Affected Vendors: RealNetworks
-- Affected Products: RealNetworks RealPlayer
-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 8279.
-- Vendor Response: RealNetworks has issued an update to correct this vulnerability. More details can be found at:
http://service.real.com/realplayer/security/12102010_player/en/
-- Disclosure Timeline: 2009-06-25 - Vulnerability reported to vendor 2010-12-10 - Coordinated public release of advisory
-- Credit: This vulnerability was discovered by: * Anonymous
-- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial: http://secunia.com/products/corporate/vim/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38550
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/38550/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
RELEASE DATE: 2010-12-12
DISCUSS ADVISORY: http://secunia.com/advisories/38550/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/38550/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system.
1) An error exists when parsing RealAudio content encoded using the "cook" codec. This can be exploited to trigger the use of uninitialised memory and potentially cause a memory corruption via e.g. a specially crafted RealMedia file.
2) An error in the handling of errors encountered while decoding "cook"-encoded audio content can be exploited to trigger the use of uninitialised memory and potentially free an arbitrary address.
3) An error in the parsing of AAC audio content can be exploited to corrupt memory via specially crafted spectral data.
4) An array indexing error when parsing Media Properties Header (MDPR) in a RealMedia file can be exploited to corrupt memory.
5) An input validation error when parsing a RealMedia file can be exploited to cause a buffer overflow via a specially crafted multi-rate audio stream.
6) An error in the processing of the "StreamTitle" tag in a SHOUTcast stream using the ICY protocol can be exploited to cause an allocation failure for heap memory, which can result in the usage of freed pointers.
8) An input validation error in the "pnen3260.dll" module in the parsing of TIT2 atoms within AAC files can be exploited to corrupt memory.
9) An integer overflow in the parsing of GIF87a files over the streaming protocol RTSP can be exploited to cause a buffer overflow via a large "Screen Width" size in the "Screen Descriptor" header.
10) An error in the parsing of audio codec information in a Real Audio media file can be exploited to to cause a heap-based buffer overflow via a large number of subbands.
11) An input validation error in drv2.dll when decompressing RV20 video streams can be exploited to corrupt heap memory.
12) An unspecified error related to "SIPR" parsing can be exploited to corrupt heap memory.
13) An unspecified error related to "SOUND" processing can be exploited to corrupt heap memory.
14) An unspecified error related to "AAC" processing can be exploited to corrupt heap memory.
15) An unspecified error related to "RealMedia" processing can be exploited to corrupt heap memory.
16) An unspecified error related to "RA5" processing can be exploited to corrupt heap memory.
17) An integer overflow in "drv1.dll" when parsing SIPR stream metadata can be exploited to cause a heap-based buffer overflow, e.g. via the RealPlayer ActiveX control.
18) An input validation error in the processing of RealMedia files can be exploited to corrupt heap memory.
19) An input validation error in the RealAudio codec when processing RealMedia files can be exploited to corrupt heap memory.
20) An error in the "HandleAction" method in the RealPlayer ActiveX control allows users to download and execute scripts in the "Local Zone".
21) Input sanitisation errors in the "Custsupport.html", "Main.html", and "Upsell.htm" components can be exploited to inject arbitrary code into the RealOneActiveXObject process and load unsafe controls.
22) A boundary error in the parsing of cook-specific data used for initialization can be exploited to cause a heap-based buffer overflow.
23) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to cause a heap-based buffer overflow via an invalid size for an embedded MDPR chunk.
24) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to corrupt heap memory via an invalid number streams within the chunk.
25) An input validation error when parsing the RMX file format can be exploited to cause a heap-based buffer overflow.
26) An error when decoding data for particular mime types within a RealMedia file can be exploited to cause a heap-based buffer overflow.
27) An error in the parsing of server headers can be exploited to cause a heap-based buffer overflow via an image tag pointing to a malicious server, which causes the player to fetch a remote file.
28) An error in the implementation of the Advanced Audio Coding compression when decoding a conditional component of a data block within an AAC frame can be exploited to corrupt memory.
SOLUTION: Upgrade to RealPlayer 14.0.0 or later.
PROVIDED AND/OR DISCOVERED BY: 1, 2) Alin Rad Pop, Secunia Research. 3) Carsten Eiram, Secunia Research. 4) Anonymous and Hossein Lotfi, reported via ZDI. 5 - 11, 20, 21) Anonymous, reported via ZDI. 12 - 14) The vendor credits Nicolas Joly, Vupen 15) The vendor credits Chaouki Bekrar, Vupen 17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs 18, 19) Omair, reported via iDefense. 22, 28) Damian Put, reported via ZDI. 23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team lollersk8erz. 25) Sebastian Apelt, reported via ZDI. 26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. 27) AbdulAziz Hariri, reported via ZDI.
ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2010-9/ http://secunia.com/secunia_research/2010-14/ http://secunia.com/secunia_research/2010-15/
RealNetworks: http://service.real.com/realplayer/security/12102010_player/en/ http://realnetworksblog.com/?p=2216
ZDI: http://www.zerodayinitiative.com/advisories/ZDI-10-268/ http://www.zerodayinitiative.com/advisories/ZDI-10-266/ http://www.zerodayinitiative.com/advisories/ZDI-10-270/ http://www.zerodayinitiative.com/advisories/ZDI-10-273/ http://www.zerodayinitiative.com/advisories/ZDI-10-269/ http://www.zerodayinitiative.com/advisories/ZDI-10-271/ http://www.zerodayinitiative.com/advisories/ZDI-10-272/ http://www.zerodayinitiative.com/advisories/ZDI-10-274/ http://www.zerodayinitiative.com/advisories/ZDI-10-275/ http://www.zerodayinitiative.com/advisories/ZDI-10-276/ http://www.zerodayinitiative.com/advisories/ZDI-10-277/ http://www.zerodayinitiative.com/advisories/ZDI-10-278/ http://www.zerodayinitiative.com/advisories/ZDI-10-279/ http://www.zerodayinitiative.com/advisories/ZDI-10-281/ http://www.zerodayinitiative.com/advisories/ZDI-10-280/ http://www.zerodayinitiative.com/advisories/ZDI-10-282/ http://www.zerodayinitiative.com/advisories/ZDI-10-267/
TippingPoint DVLabs: http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html
iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201012-0224",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer sp",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "1.0.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "1.1.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.0.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0.2.1744 (linux)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0 to 1.0.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.2 to 1.1.1"
},
{
"model": "realplayer",
"scope": null,
"trust": 0.7,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "116.0.14.550"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer for mac",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "12.0.0.1548"
},
{
"model": "realplayer for linux",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0.2.2315"
},
{
"model": "realplayer",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "14.0.1"
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.3"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.3"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.4"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-269"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45410"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002586"
},
{
"db": "NVD",
"id": "CVE-2010-4397"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-168"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4397"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Anonymous",
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-269"
},
{
"db": "BID",
"id": "45410"
}
],
"trust": 1.0
},
"cve": "CVE-2010-4397",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-4397",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2010-4397",
"impactScore": 8.5,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-47002",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-4397",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2010-4397",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201012-168",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-47002",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-269"
},
{
"db": "VULHUB",
"id": "VHN-47002"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002586"
},
{
"db": "NVD",
"id": "CVE-2010-4397"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-168"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Integer overflow in the pnen3260.dll module in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code via a crafted TIT2 atom in an AAC file. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists in RealPlayer\u0027s pnen3260.dll module while parsing the TIT2 atom within AAC files. The code within this module does not account for a negative size during an allocation and later uses the value as unsigned within a copy loop. Real Networks RealPlayer is prone to an integer-overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. \nNOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. ZDI-10-269: RealNetworks RealPlayer AAC TIT2 Atom Integer Overflow Remote Code Execution Vulnerability\n\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-269\n\nDecember 10, 2010\n\n-- CVE ID:\nCVE-2010-4397\n\n-- CVSS:\n9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)\n\n-- Affected Vendors:\nRealNetworks\n\n-- Affected Products:\nRealNetworks RealPlayer\n\n-- TippingPoint(TM) IPS Customer Protection:\nTippingPoint IPS customers have been protected against this\nvulnerability by Digital Vaccine protection filter ID 8279. \n\n-- Vendor Response:\nRealNetworks has issued an update to correct this vulnerability. More\ndetails can be found at:\n\nhttp://service.real.com/realplayer/security/12102010_player/en/\n\n-- Disclosure Timeline:\n2009-06-25 - Vulnerability reported to vendor\n2010-12-10 - Coordinated public release of advisory\n\n-- Credit:\nThis vulnerability was discovered by:\n * Anonymous\n\n-- About the Zero Day Initiative (ZDI):\nEstablished by TippingPoint, The Zero Day Initiative (ZDI) represents\na best-of-breed model for rewarding security researchers for responsibly\ndisclosing discovered vulnerabilities. \n\nResearchers interested in getting paid for their security research\nthrough the ZDI can find more information and sign-up at:\n\n http://www.zerodayinitiative.com\n\nThe ZDI is unique in how the acquired vulnerability information is\nused. TippingPoint does not re-sell the vulnerability details or any\nexploit code. Instead, upon notifying the affected product vendor,\nTippingPoint provides its customers with zero day protection through\nits intrusion prevention technology. Explicit details regarding the\nspecifics of the vulnerability are not exposed to any parties until\nan official vendor patch is publicly available. Furthermore, with the\naltruistic aim of helping to secure a broader user base, TippingPoint\nprovides this vulnerability information confidentially to security\nvendors (including competitors) who have a vulnerability protection or\nmitigation product. \n\nOur vulnerability disclosure policy is available online at:\n\n http://www.zerodayinitiative.com/advisories/disclosure_policy/\n\nFollow the ZDI on Twitter:\n\n http://twitter.com/thezdi\n\n\n. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nRequest a free trial: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38550\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/38550/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nRELEASE DATE:\n2010-12-12\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/38550/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/38550/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in RealPlayer, which can\nbe exploited by malicious people to compromise a user\u0027s system. \n\n1) An error exists when parsing RealAudio content encoded using the\n\"cook\" codec. This can be exploited to trigger the use of\nuninitialised memory and potentially cause a memory corruption via\ne.g. a specially crafted RealMedia file. \n\n2) An error in the handling of errors encountered while decoding\n\"cook\"-encoded audio content can be exploited to trigger the use of\nuninitialised memory and potentially free an arbitrary address. \n\n3) An error in the parsing of AAC audio content can be exploited to\ncorrupt memory via specially crafted spectral data. \n\n4) An array indexing error when parsing Media Properties Header\n(MDPR) in a RealMedia file can be exploited to corrupt memory. \n\n5) An input validation error when parsing a RealMedia file can be\nexploited to cause a buffer overflow via a specially crafted\nmulti-rate audio stream. \n\n6) An error in the processing of the \"StreamTitle\" tag in a SHOUTcast\nstream using the ICY protocol can be exploited to cause an allocation\nfailure for heap memory, which can result in the usage of freed\npointers. \n\n8) An input validation error in the \"pnen3260.dll\" module in the\nparsing of TIT2 atoms within AAC files can be exploited to corrupt\nmemory. \n\n9) An integer overflow in the parsing of GIF87a files over the\nstreaming protocol RTSP can be exploited to cause a buffer overflow\nvia a large \"Screen Width\" size in the \"Screen Descriptor\" header. \n\n10) An error in the parsing of audio codec information in a Real\nAudio media file can be exploited to to cause a heap-based buffer\noverflow via a large number of subbands. \n\n11) An input validation error in drv2.dll when decompressing RV20\nvideo streams can be exploited to corrupt heap memory. \n\n12) An unspecified error related to \"SIPR\" parsing can be exploited\nto corrupt heap memory. \n\n13) An unspecified error related to \"SOUND\" processing can be\nexploited to corrupt heap memory. \n\n14) An unspecified error related to \"AAC\" processing can be exploited\nto corrupt heap memory. \n\n15) An unspecified error related to \"RealMedia\" processing can be\nexploited to corrupt heap memory. \n\n16) An unspecified error related to \"RA5\" processing can be exploited\nto corrupt heap memory. \n\n17) An integer overflow in \"drv1.dll\" when parsing SIPR stream\nmetadata can be exploited to cause a heap-based buffer overflow, e.g. \nvia the RealPlayer ActiveX control. \n\n18) An input validation error in the processing of RealMedia files\ncan be exploited to corrupt heap memory. \n\n19) An input validation error in the RealAudio codec when processing\nRealMedia files can be exploited to corrupt heap memory. \n\n20) An error in the \"HandleAction\" method in the RealPlayer ActiveX\ncontrol allows users to download and execute scripts in the \"Local\nZone\". \n\n21) Input sanitisation errors in the \"Custsupport.html\", \"Main.html\",\nand \"Upsell.htm\" components can be exploited to inject arbitrary code\ninto the RealOneActiveXObject process and load unsafe controls. \n\n22) A boundary error in the parsing of cook-specific data used for\ninitialization can be exploited to cause a heap-based buffer\noverflow. \n\n23) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to cause a heap-based\nbuffer overflow via an invalid size for an embedded MDPR chunk. \n\n24) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to corrupt heap memory\nvia an invalid number streams within the chunk. \n\n25) An input validation error when parsing the RMX file format can be\nexploited to cause a heap-based buffer overflow. \n\n26) An error when decoding data for particular mime types within a\nRealMedia file can be exploited to cause a heap-based buffer\noverflow. \n\n27) An error in the parsing of server headers can be exploited to\ncause a heap-based buffer overflow via an image tag pointing to a\nmalicious server, which causes the player to fetch a remote file. \n\n28) An error in the implementation of the Advanced Audio Coding\ncompression when decoding a conditional component of a data block\nwithin an AAC frame can be exploited to corrupt memory. \n\nSOLUTION:\nUpgrade to RealPlayer 14.0.0 or later. \n\nPROVIDED AND/OR DISCOVERED BY:\n1, 2) Alin Rad Pop, Secunia Research. \n3) Carsten Eiram, Secunia Research. \n4) Anonymous and Hossein Lotfi, reported via ZDI. \n5 - 11, 20, 21) Anonymous, reported via ZDI. \n12 - 14) The vendor credits Nicolas Joly, Vupen\n15) The vendor credits Chaouki Bekrar, Vupen\n17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs\n18, 19) Omair, reported via iDefense. \n22, 28) Damian Put, reported via ZDI. \n23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team\nlollersk8erz. \n25) Sebastian Apelt, reported via ZDI. \n26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. \n27) AbdulAziz Hariri, reported via ZDI. \n\nORIGINAL ADVISORY:\nSecunia Research:\nhttp://secunia.com/secunia_research/2010-9/\nhttp://secunia.com/secunia_research/2010-14/\nhttp://secunia.com/secunia_research/2010-15/\n\nRealNetworks:\nhttp://service.real.com/realplayer/security/12102010_player/en/\nhttp://realnetworksblog.com/?p=2216\n\nZDI:\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-268/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-266/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-270/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-273/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-269/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-271/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-272/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-274/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-275/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-276/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-277/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-278/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-279/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-281/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-280/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-282/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-267/\n\nTippingPoint DVLabs:\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html\n\niDefense Labs:\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4397"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002586"
},
{
"db": "ZDI",
"id": "ZDI-10-269"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45410"
},
{
"db": "VULHUB",
"id": "VHN-47002"
},
{
"db": "PACKETSTORM",
"id": "96591"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96637"
}
],
"trust": 3.15
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-47002",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-47002"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-4397",
"trust": 3.6
},
{
"db": "ZDI",
"id": "ZDI-10-269",
"trust": 3.2
},
{
"db": "SECUNIA",
"id": "38550",
"trust": 1.6
},
{
"db": "SECUNIA",
"id": "42565",
"trust": 1.5
},
{
"db": "SECTRACK",
"id": "1024861",
"trust": 1.1
},
{
"db": "OSVDB",
"id": "69856",
"trust": 1.1
},
{
"db": "VUPEN",
"id": "ADV-2010-3190",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002586",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-490",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201012-168",
"trust": 0.7
},
{
"db": "BID",
"id": "45410",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-273",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-266",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-280",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-267",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-277",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-272",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-268",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-274",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-271",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-276",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-278",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-279",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-282",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-270",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-275",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-281",
"trust": 0.4
},
{
"db": "BID",
"id": "45327",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "96591",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-47002",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96637",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-269"
},
{
"db": "VULHUB",
"id": "VHN-47002"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45410"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002586"
},
{
"db": "PACKETSTORM",
"id": "96591"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4397"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-168"
}
]
},
"id": "VAR-201012-0224",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-47002"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:10:59.209000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/ja"
},
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/en"
},
{
"title": "RealNetworks has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"title": "RealPlayerSP",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35884"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35883"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35882"
},
{
"title": "RealPlayer",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35881"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-269"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002586"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-168"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-189",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-47002"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002586"
},
{
"db": "NVD",
"id": "CVE-2010-4397"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"trust": 2.4,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/38550"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/42565"
},
{
"trust": 1.1,
"url": "http://osvdb.org/69856"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id?1024861"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4397"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-4397"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2010/3190"
},
{
"trust": 0.6,
"url": "http://realnetworksblog.com/?p=2192"
},
{
"trust": 0.6,
"url": "http://dvlabs.tippingpoint.com/blog/2010/12/09/realnetworks-patches-27-vulnerabilities"
},
{
"trust": 0.6,
"url": "http://www.real.com/"
},
{
"trust": 0.4,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883"
},
{
"trust": 0.4,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884"
},
{
"trust": 0.3,
"url": "/archive/1/515235"
},
{
"trust": 0.3,
"url": "/archive/1/515236"
},
{
"trust": 0.3,
"url": "/archive/1/515238"
},
{
"trust": 0.3,
"url": "/archive/1/515237"
},
{
"trust": 0.3,
"url": "/archive/1/515234"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/advisory/tpti-10-18"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/advisory/tpti-10-19"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282"
},
{
"trust": 0.2,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.2,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.2,
"url": "http://realnetworksblog.com/?p=2216"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/disclosure_policy/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-4397"
},
{
"trust": 0.1,
"url": "http://twitter.com/thezdi"
},
{
"trust": 0.1,
"url": "http://www.tippingpoint.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-14/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-15/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-9/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/#comments"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42565"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-269"
},
{
"db": "VULHUB",
"id": "VHN-47002"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45410"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002586"
},
{
"db": "PACKETSTORM",
"id": "96591"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4397"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-168"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-10-269"
},
{
"db": "VULHUB",
"id": "VHN-47002"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45410"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002586"
},
{
"db": "PACKETSTORM",
"id": "96591"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4397"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-168"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-10T00:00:00",
"db": "ZDI",
"id": "ZDI-10-269"
},
{
"date": "2010-12-14T00:00:00",
"db": "VULHUB",
"id": "VHN-47002"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45327"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45410"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002586"
},
{
"date": "2010-12-11T15:17:22",
"db": "PACKETSTORM",
"id": "96591"
},
{
"date": "2010-12-13T04:13:47",
"db": "PACKETSTORM",
"id": "96636"
},
{
"date": "2010-12-13T04:13:50",
"db": "PACKETSTORM",
"id": "96637"
},
{
"date": "2010-12-14T16:00:05.180000",
"db": "NVD",
"id": "CVE-2010-4397"
},
{
"date": "2010-12-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-168"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-10T00:00:00",
"db": "ZDI",
"id": "ZDI-10-269"
},
{
"date": "2011-01-19T00:00:00",
"db": "VULHUB",
"id": "VHN-47002"
},
{
"date": "2010-12-16T22:14:00",
"db": "BID",
"id": "45327"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45410"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002586"
},
{
"date": "2011-01-19T07:02:16.800000",
"db": "NVD",
"id": "CVE-2010-4397"
},
{
"date": "2010-12-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-168"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "96591"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-168"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer of pnen3260.dll Module integer overflow vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002586"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "digital error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-168"
}
],
"trust": 0.6
}
}
VAR-201012-0245
Vulnerability from variot - Updated: 2023-12-18 12:10Array index error in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer Enterprise 2.1.2, Mac RealPlayer 11.0 through 11.1, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code via a malformed Media Properties Header (aka MDPR) in a RealMedia file. The application explicitly trusts an index in this data structure which is used to seek into an array of objects. If an attacker can allocate controlled data at some point after this array, an attacker can then get their fabricated object to get called leading to code execution under the context of the current user. Real Networks RealPlayer is prone to a memory-corruption vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. This issue affects Windows RealPlayer 11.1 and prior, RealPlayer Enterprise 2.1.2 and prior, Mac RealPlayer 11.0.1.949 and prior, and Linux RealPlayer 11.0.2.1744 and prior. NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial: http://secunia.com/products/corporate/vim/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38550
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/38550/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
RELEASE DATE: 2010-12-12
DISCUSS ADVISORY: http://secunia.com/advisories/38550/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/38550/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system.
1) An error exists when parsing RealAudio content encoded using the "cook" codec. This can be exploited to trigger the use of uninitialised memory and potentially cause a memory corruption via e.g. a specially crafted RealMedia file.
2) An error in the handling of errors encountered while decoding "cook"-encoded audio content can be exploited to trigger the use of uninitialised memory and potentially free an arbitrary address.
3) An error in the parsing of AAC audio content can be exploited to corrupt memory via specially crafted spectral data.
4) An array indexing error when parsing Media Properties Header (MDPR) in a RealMedia file can be exploited to corrupt memory.
5) An input validation error when parsing a RealMedia file can be exploited to cause a buffer overflow via a specially crafted multi-rate audio stream.
6) An error in the processing of the "StreamTitle" tag in a SHOUTcast stream using the ICY protocol can be exploited to cause an allocation failure for heap memory, which can result in the usage of freed pointers.
7) An integer overflow error when parsing a MLLT atom in an .AAC file can be exploited to cause a buffer overflow.
8) An input validation error in the "pnen3260.dll" module in the parsing of TIT2 atoms within AAC files can be exploited to corrupt memory.
9) An integer overflow in the parsing of GIF87a files over the streaming protocol RTSP can be exploited to cause a buffer overflow via a large "Screen Width" size in the "Screen Descriptor" header.
10) An error in the parsing of audio codec information in a Real Audio media file can be exploited to to cause a heap-based buffer overflow via a large number of subbands.
11) An input validation error in drv2.dll when decompressing RV20 video streams can be exploited to corrupt heap memory.
12) An unspecified error related to "SIPR" parsing can be exploited to corrupt heap memory.
13) An unspecified error related to "SOUND" processing can be exploited to corrupt heap memory.
14) An unspecified error related to "AAC" processing can be exploited to corrupt heap memory.
15) An unspecified error related to "RealMedia" processing can be exploited to corrupt heap memory.
16) An unspecified error related to "RA5" processing can be exploited to corrupt heap memory.
17) An integer overflow in "drv1.dll" when parsing SIPR stream metadata can be exploited to cause a heap-based buffer overflow, e.g. via the RealPlayer ActiveX control.
18) An input validation error in the processing of RealMedia files can be exploited to corrupt heap memory.
19) An input validation error in the RealAudio codec when processing RealMedia files can be exploited to corrupt heap memory.
20) An error in the "HandleAction" method in the RealPlayer ActiveX control allows users to download and execute scripts in the "Local Zone".
21) Input sanitisation errors in the "Custsupport.html", "Main.html", and "Upsell.htm" components can be exploited to inject arbitrary code into the RealOneActiveXObject process and load unsafe controls.
22) A boundary error in the parsing of cook-specific data used for initialization can be exploited to cause a heap-based buffer overflow.
23) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to cause a heap-based buffer overflow via an invalid size for an embedded MDPR chunk.
24) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to corrupt heap memory via an invalid number streams within the chunk.
25) An input validation error when parsing the RMX file format can be exploited to cause a heap-based buffer overflow.
26) An error when decoding data for particular mime types within a RealMedia file can be exploited to cause a heap-based buffer overflow.
27) An error in the parsing of server headers can be exploited to cause a heap-based buffer overflow via an image tag pointing to a malicious server, which causes the player to fetch a remote file.
28) An error in the implementation of the Advanced Audio Coding compression when decoding a conditional component of a data block within an AAC frame can be exploited to corrupt memory.
SOLUTION: Upgrade to RealPlayer 14.0.0 or later.
PROVIDED AND/OR DISCOVERED BY: 1, 2) Alin Rad Pop, Secunia Research. 3) Carsten Eiram, Secunia Research. 4) Anonymous and Hossein Lotfi, reported via ZDI. 5 - 11, 20, 21) Anonymous, reported via ZDI. 12 - 14) The vendor credits Nicolas Joly, Vupen 15) The vendor credits Chaouki Bekrar, Vupen 17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs 18, 19) Omair, reported via iDefense. 22, 28) Damian Put, reported via ZDI. 23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team lollersk8erz. 25) Sebastian Apelt, reported via ZDI. 26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. 27) AbdulAziz Hariri, reported via ZDI.
ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2010-9/ http://secunia.com/secunia_research/2010-14/ http://secunia.com/secunia_research/2010-15/
RealNetworks: http://service.real.com/realplayer/security/12102010_player/en/ http://realnetworksblog.com/?p=2216
ZDI: http://www.zerodayinitiative.com/advisories/ZDI-10-268/ http://www.zerodayinitiative.com/advisories/ZDI-10-266/ http://www.zerodayinitiative.com/advisories/ZDI-10-270/ http://www.zerodayinitiative.com/advisories/ZDI-10-273/ http://www.zerodayinitiative.com/advisories/ZDI-10-269/ http://www.zerodayinitiative.com/advisories/ZDI-10-271/ http://www.zerodayinitiative.com/advisories/ZDI-10-272/ http://www.zerodayinitiative.com/advisories/ZDI-10-274/ http://www.zerodayinitiative.com/advisories/ZDI-10-275/ http://www.zerodayinitiative.com/advisories/ZDI-10-276/ http://www.zerodayinitiative.com/advisories/ZDI-10-277/ http://www.zerodayinitiative.com/advisories/ZDI-10-278/ http://www.zerodayinitiative.com/advisories/ZDI-10-279/ http://www.zerodayinitiative.com/advisories/ZDI-10-281/ http://www.zerodayinitiative.com/advisories/ZDI-10-280/ http://www.zerodayinitiative.com/advisories/ZDI-10-282/ http://www.zerodayinitiative.com/advisories/ZDI-10-267/
TippingPoint DVLabs: http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html
iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. ZDI-10-268: RealNetworks RealPlayer Media Properties Header Parsing Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-10-268
December 10, 2010
-- CVE ID: CVE-2010-4384
-- CVSS: 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)
-- Affected Vendors: RealNetworks
-- Affected Products: RealNetworks RealPlayer
-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 6853.
-- Vendor Response: RealNetworks has issued an update to correct this vulnerability. More details can be found at:
http://service.real.com/realplayer/security/12102010_player/en/
-- Disclosure Timeline: 2009-02-24 - Vulnerability reported to vendor 2010-12-10 - Coordinated public release of advisory
-- Credit: This vulnerability was discovered by: * Anonymous * Hossein Lotfi
-- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201012-0245",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "2.1.2"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "(enterprise) 2.1.2"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0.2.1744 (linux)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (es)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.0"
},
{
"model": "realplayer",
"scope": null,
"trust": 0.7,
"vendor": "realnetworks",
"version": null
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "2.1.2"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "116.0.14.550"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer for linux",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0.2.2315"
},
{
"model": "realplayer enterprise",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "2.1.4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.3"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.3"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for mac",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "12.0.0.1548"
},
{
"model": "realplayer",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "14.0.1"
},
{
"model": "realplayer for mac",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.1"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-268"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45449"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002582"
},
{
"db": "NVD",
"id": "CVE-2010-4384"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-151"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:2.1.2:*:enterprise:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4384"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "AnonymousHossein Lotfi",
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-268"
}
],
"trust": 0.7
},
"cve": "CVE-2010-4384",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-4384",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2010-4384",
"impactScore": 8.5,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-46989",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-4384",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2010-4384",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201012-151",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-46989",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2010-4384",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-268"
},
{
"db": "VULHUB",
"id": "VHN-46989"
},
{
"db": "VULMON",
"id": "CVE-2010-4384"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002582"
},
{
"db": "NVD",
"id": "CVE-2010-4384"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-151"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Array index error in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer Enterprise 2.1.2, Mac RealPlayer 11.0 through 11.1, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code via a malformed Media Properties Header (aka MDPR) in a RealMedia file. The application explicitly trusts an index in this data structure which is used to seek into an array of objects. If an attacker can allocate controlled data at some point after this array, an attacker can then get their fabricated object to get called leading to code execution under the context of the current user. Real Networks RealPlayer is prone to a memory-corruption vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. \nThis issue affects Windows RealPlayer 11.1 and prior, RealPlayer Enterprise 2.1.2 and prior, Mac RealPlayer 11.0.1.949 and prior, and Linux RealPlayer 11.0.2.1744 and prior. \nNOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nRequest a free trial: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38550\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/38550/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nRELEASE DATE:\n2010-12-12\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/38550/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/38550/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in RealPlayer, which can\nbe exploited by malicious people to compromise a user\u0027s system. \n\n1) An error exists when parsing RealAudio content encoded using the\n\"cook\" codec. This can be exploited to trigger the use of\nuninitialised memory and potentially cause a memory corruption via\ne.g. a specially crafted RealMedia file. \n\n2) An error in the handling of errors encountered while decoding\n\"cook\"-encoded audio content can be exploited to trigger the use of\nuninitialised memory and potentially free an arbitrary address. \n\n3) An error in the parsing of AAC audio content can be exploited to\ncorrupt memory via specially crafted spectral data. \n\n4) An array indexing error when parsing Media Properties Header\n(MDPR) in a RealMedia file can be exploited to corrupt memory. \n\n5) An input validation error when parsing a RealMedia file can be\nexploited to cause a buffer overflow via a specially crafted\nmulti-rate audio stream. \n\n6) An error in the processing of the \"StreamTitle\" tag in a SHOUTcast\nstream using the ICY protocol can be exploited to cause an allocation\nfailure for heap memory, which can result in the usage of freed\npointers. \n\n7) An integer overflow error when parsing a MLLT atom in an .AAC file\ncan be exploited to cause a buffer overflow. \n\n8) An input validation error in the \"pnen3260.dll\" module in the\nparsing of TIT2 atoms within AAC files can be exploited to corrupt\nmemory. \n\n9) An integer overflow in the parsing of GIF87a files over the\nstreaming protocol RTSP can be exploited to cause a buffer overflow\nvia a large \"Screen Width\" size in the \"Screen Descriptor\" header. \n\n10) An error in the parsing of audio codec information in a Real\nAudio media file can be exploited to to cause a heap-based buffer\noverflow via a large number of subbands. \n\n11) An input validation error in drv2.dll when decompressing RV20\nvideo streams can be exploited to corrupt heap memory. \n\n12) An unspecified error related to \"SIPR\" parsing can be exploited\nto corrupt heap memory. \n\n13) An unspecified error related to \"SOUND\" processing can be\nexploited to corrupt heap memory. \n\n14) An unspecified error related to \"AAC\" processing can be exploited\nto corrupt heap memory. \n\n15) An unspecified error related to \"RealMedia\" processing can be\nexploited to corrupt heap memory. \n\n16) An unspecified error related to \"RA5\" processing can be exploited\nto corrupt heap memory. \n\n17) An integer overflow in \"drv1.dll\" when parsing SIPR stream\nmetadata can be exploited to cause a heap-based buffer overflow, e.g. \nvia the RealPlayer ActiveX control. \n\n18) An input validation error in the processing of RealMedia files\ncan be exploited to corrupt heap memory. \n\n19) An input validation error in the RealAudio codec when processing\nRealMedia files can be exploited to corrupt heap memory. \n\n20) An error in the \"HandleAction\" method in the RealPlayer ActiveX\ncontrol allows users to download and execute scripts in the \"Local\nZone\". \n\n21) Input sanitisation errors in the \"Custsupport.html\", \"Main.html\",\nand \"Upsell.htm\" components can be exploited to inject arbitrary code\ninto the RealOneActiveXObject process and load unsafe controls. \n\n22) A boundary error in the parsing of cook-specific data used for\ninitialization can be exploited to cause a heap-based buffer\noverflow. \n\n23) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to cause a heap-based\nbuffer overflow via an invalid size for an embedded MDPR chunk. \n\n24) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to corrupt heap memory\nvia an invalid number streams within the chunk. \n\n25) An input validation error when parsing the RMX file format can be\nexploited to cause a heap-based buffer overflow. \n\n26) An error when decoding data for particular mime types within a\nRealMedia file can be exploited to cause a heap-based buffer\noverflow. \n\n27) An error in the parsing of server headers can be exploited to\ncause a heap-based buffer overflow via an image tag pointing to a\nmalicious server, which causes the player to fetch a remote file. \n\n28) An error in the implementation of the Advanced Audio Coding\ncompression when decoding a conditional component of a data block\nwithin an AAC frame can be exploited to corrupt memory. \n\nSOLUTION:\nUpgrade to RealPlayer 14.0.0 or later. \n\nPROVIDED AND/OR DISCOVERED BY:\n1, 2) Alin Rad Pop, Secunia Research. \n3) Carsten Eiram, Secunia Research. \n4) Anonymous and Hossein Lotfi, reported via ZDI. \n5 - 11, 20, 21) Anonymous, reported via ZDI. \n12 - 14) The vendor credits Nicolas Joly, Vupen\n15) The vendor credits Chaouki Bekrar, Vupen\n17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs\n18, 19) Omair, reported via iDefense. \n22, 28) Damian Put, reported via ZDI. \n23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team\nlollersk8erz. \n25) Sebastian Apelt, reported via ZDI. \n26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. \n27) AbdulAziz Hariri, reported via ZDI. \n\nORIGINAL ADVISORY:\nSecunia Research:\nhttp://secunia.com/secunia_research/2010-9/\nhttp://secunia.com/secunia_research/2010-14/\nhttp://secunia.com/secunia_research/2010-15/\n\nRealNetworks:\nhttp://service.real.com/realplayer/security/12102010_player/en/\nhttp://realnetworksblog.com/?p=2216\n\nZDI:\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-268/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-266/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-270/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-273/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-269/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-271/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-272/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-274/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-275/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-276/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-277/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-278/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-279/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-281/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-280/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-282/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-267/\n\nTippingPoint DVLabs:\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html\n\niDefense Labs:\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. ZDI-10-268: RealNetworks RealPlayer Media Properties Header Parsing Remote Code Execution Vulnerability\n\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-268\n\nDecember 10, 2010\n\n-- CVE ID:\nCVE-2010-4384\n\n-- CVSS:\n9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)\n\n-- Affected Vendors:\nRealNetworks\n\n-- Affected Products:\nRealNetworks RealPlayer\n\n-- TippingPoint(TM) IPS Customer Protection:\nTippingPoint IPS customers have been protected against this\nvulnerability by Digital Vaccine protection filter ID 6853. \n\n-- Vendor Response:\nRealNetworks has issued an update to correct this vulnerability. More\ndetails can be found at:\n\nhttp://service.real.com/realplayer/security/12102010_player/en/\n\n-- Disclosure Timeline:\n2009-02-24 - Vulnerability reported to vendor\n2010-12-10 - Coordinated public release of advisory\n\n-- Credit:\nThis vulnerability was discovered by:\n * Anonymous\n * Hossein Lotfi\n\n-- About the Zero Day Initiative (ZDI):\nEstablished by TippingPoint, The Zero Day Initiative (ZDI) represents\na best-of-breed model for rewarding security researchers for responsibly\ndisclosing discovered vulnerabilities. \n\nResearchers interested in getting paid for their security research\nthrough the ZDI can find more information and sign-up at:\n\n http://www.zerodayinitiative.com\n\nThe ZDI is unique in how the acquired vulnerability information is\nused. TippingPoint does not re-sell the vulnerability details or any\nexploit code. Instead, upon notifying the affected product vendor,\nTippingPoint provides its customers with zero day protection through\nits intrusion prevention technology. Explicit details regarding the\nspecifics of the vulnerability are not exposed to any parties until\nan official vendor patch is publicly available. Furthermore, with the\naltruistic aim of helping to secure a broader user base, TippingPoint\nprovides this vulnerability information confidentially to security\nvendors (including competitors) who have a vulnerability protection or\nmitigation product. \n\nOur vulnerability disclosure policy is available online at:\n\n http://www.zerodayinitiative.com/advisories/disclosure_policy/\n\nFollow the ZDI on Twitter:\n\n http://twitter.com/thezdi\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4384"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002582"
},
{
"db": "ZDI",
"id": "ZDI-10-268"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45449"
},
{
"db": "VULHUB",
"id": "VHN-46989"
},
{
"db": "VULMON",
"id": "CVE-2010-4384"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96590"
},
{
"db": "PACKETSTORM",
"id": "96637"
}
],
"trust": 3.33
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-46989",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46989"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-4384",
"trust": 3.7
},
{
"db": "ZDI",
"id": "ZDI-10-268",
"trust": 3.3
},
{
"db": "SECUNIA",
"id": "38550",
"trust": 1.6
},
{
"db": "SECUNIA",
"id": "42565",
"trust": 1.5
},
{
"db": "SECTRACK",
"id": "1024861",
"trust": 1.2
},
{
"db": "VUPEN",
"id": "ADV-2010-3190",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002582",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-434",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201012-151",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "42333",
"trust": 0.7
},
{
"db": "BID",
"id": "45449",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-273",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-266",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-280",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-267",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-269",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-277",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-272",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-274",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-271",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-276",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-278",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-279",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-282",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-270",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-275",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-281",
"trust": 0.4
},
{
"db": "BID",
"id": "45327",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "96590",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-46989",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2010-4384",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96639",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96637",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-268"
},
{
"db": "VULHUB",
"id": "VHN-46989"
},
{
"db": "VULMON",
"id": "CVE-2010-4384"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45449"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002582"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96590"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4384"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-151"
}
]
},
"id": "VAR-201012-0245",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-46989"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:10:59.088000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/ja"
},
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/en"
},
{
"title": "RHSA-2010:0981",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2010-0981.html"
},
{
"title": "RealNetworks has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"title": "RealPlayerSP",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35884"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35883"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35882"
},
{
"title": "RealPlayer",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35881"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-268"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002582"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-151"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46989"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002582"
},
{
"db": "NVD",
"id": "CVE-2010-4384"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.5,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"trust": 2.2,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/38550"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/42565"
},
{
"trust": 1.2,
"url": "http://www.redhat.com/support/errata/rhsa-2010-0981.html"
},
{
"trust": 1.2,
"url": "http://www.securitytracker.com/id?1024861"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4384"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-4384"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2010/3190"
},
{
"trust": 0.6,
"url": "http://realnetworksblog.com/?p=2192"
},
{
"trust": 0.6,
"url": "http://dvlabs.tippingpoint.com/blog/2010/12/09/realnetworks-patches-27-vulnerabilities"
},
{
"trust": 0.6,
"url": "http://www.real.com/"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/42333"
},
{
"trust": 0.4,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883"
},
{
"trust": 0.4,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884"
},
{
"trust": 0.4,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268/"
},
{
"trust": 0.3,
"url": "/archive/1/515235"
},
{
"trust": 0.3,
"url": "/archive/1/515236"
},
{
"trust": 0.3,
"url": "/archive/1/515238"
},
{
"trust": 0.3,
"url": "/archive/1/515237"
},
{
"trust": 0.3,
"url": "/archive/1/515234"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/advisory/tpti-10-18"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/advisory/tpti-10-19"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.3,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.3,
"url": "http://realnetworksblog.com/?p=2216"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/20.html"
},
{
"trust": 0.1,
"url": "https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2010-4384"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.rapid7.com/db/vulnerabilities/linuxrpm-rhsa-2010-0981"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-14/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-15/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-9/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/#comments"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42333"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42333/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42333/#comments"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/disclosure_policy/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-4384"
},
{
"trust": 0.1,
"url": "http://twitter.com/thezdi"
},
{
"trust": 0.1,
"url": "http://www.tippingpoint.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42565"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-268"
},
{
"db": "VULHUB",
"id": "VHN-46989"
},
{
"db": "VULMON",
"id": "CVE-2010-4384"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45449"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002582"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96590"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4384"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-151"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-10-268"
},
{
"db": "VULHUB",
"id": "VHN-46989"
},
{
"db": "VULMON",
"id": "CVE-2010-4384"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45449"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002582"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96590"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4384"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-151"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-10T00:00:00",
"db": "ZDI",
"id": "ZDI-10-268"
},
{
"date": "2010-12-14T00:00:00",
"db": "VULHUB",
"id": "VHN-46989"
},
{
"date": "2010-12-14T00:00:00",
"db": "VULMON",
"id": "CVE-2010-4384"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45327"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45449"
},
{
"date": "2011-01-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002582"
},
{
"date": "2010-12-13T04:13:47",
"db": "PACKETSTORM",
"id": "96636"
},
{
"date": "2010-12-13T04:13:55",
"db": "PACKETSTORM",
"id": "96639"
},
{
"date": "2010-12-11T15:16:44",
"db": "PACKETSTORM",
"id": "96590"
},
{
"date": "2010-12-13T04:13:50",
"db": "PACKETSTORM",
"id": "96637"
},
{
"date": "2010-12-14T16:00:04.647000",
"db": "NVD",
"id": "CVE-2010-4384"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-151"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-10T00:00:00",
"db": "ZDI",
"id": "ZDI-10-268"
},
{
"date": "2011-01-26T00:00:00",
"db": "VULHUB",
"id": "VHN-46989"
},
{
"date": "2011-01-26T00:00:00",
"db": "VULMON",
"id": "CVE-2010-4384"
},
{
"date": "2010-12-16T22:14:00",
"db": "BID",
"id": "45327"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45449"
},
{
"date": "2011-01-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002582"
},
{
"date": "2011-01-26T06:52:15.617000",
"db": "NVD",
"id": "CVE-2010-4384"
},
{
"date": "2011-07-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-151"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45449"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer of RealMedia Media code header arbitrary code execution vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002582"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-151"
}
],
"trust": 0.6
}
}
VAR-201012-0204
Vulnerability from variot - Updated: 2023-12-18 12:10The cook codec in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, RealPlayer Enterprise 2.1.2, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 does not properly initialize the number of channels, which allows attackers to obtain unspecified "memory access" via unknown vectors. Real Networks RealPlayer is prone to a memory-access vulnerability. Successful exploits may allow attackers to gain access to sensitive information, cause a denial-of-service condition or memory corruption. RealPlayer is a software package released and maintained by Real Networks, which can be used to play multimedia files encoded in Real Media format. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial: http://secunia.com/products/corporate/vim/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38550
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/38550/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
RELEASE DATE: 2010-12-12
DISCUSS ADVISORY: http://secunia.com/advisories/38550/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/38550/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system.
1) An error exists when parsing RealAudio content encoded using the "cook" codec. This can be exploited to trigger the use of uninitialised memory and potentially cause a memory corruption via e.g. a specially crafted RealMedia file.
2) An error in the handling of errors encountered while decoding "cook"-encoded audio content can be exploited to trigger the use of uninitialised memory and potentially free an arbitrary address.
3) An error in the parsing of AAC audio content can be exploited to corrupt memory via specially crafted spectral data.
4) An array indexing error when parsing Media Properties Header (MDPR) in a RealMedia file can be exploited to corrupt memory.
5) An input validation error when parsing a RealMedia file can be exploited to cause a buffer overflow via a specially crafted multi-rate audio stream.
6) An error in the processing of the "StreamTitle" tag in a SHOUTcast stream using the ICY protocol can be exploited to cause an allocation failure for heap memory, which can result in the usage of freed pointers.
7) An integer overflow error when parsing a MLLT atom in an .AAC file can be exploited to cause a buffer overflow.
8) An input validation error in the "pnen3260.dll" module in the parsing of TIT2 atoms within AAC files can be exploited to corrupt memory.
9) An integer overflow in the parsing of GIF87a files over the streaming protocol RTSP can be exploited to cause a buffer overflow via a large "Screen Width" size in the "Screen Descriptor" header.
10) An error in the parsing of audio codec information in a Real Audio media file can be exploited to to cause a heap-based buffer overflow via a large number of subbands.
11) An input validation error in drv2.dll when decompressing RV20 video streams can be exploited to corrupt heap memory.
12) An unspecified error related to "SIPR" parsing can be exploited to corrupt heap memory.
13) An unspecified error related to "SOUND" processing can be exploited to corrupt heap memory.
14) An unspecified error related to "AAC" processing can be exploited to corrupt heap memory.
15) An unspecified error related to "RealMedia" processing can be exploited to corrupt heap memory.
16) An unspecified error related to "RA5" processing can be exploited to corrupt heap memory.
17) An integer overflow in "drv1.dll" when parsing SIPR stream metadata can be exploited to cause a heap-based buffer overflow, e.g. via the RealPlayer ActiveX control.
18) An input validation error in the processing of RealMedia files can be exploited to corrupt heap memory.
19) An input validation error in the RealAudio codec when processing RealMedia files can be exploited to corrupt heap memory.
20) An error in the "HandleAction" method in the RealPlayer ActiveX control allows users to download and execute scripts in the "Local Zone".
21) Input sanitisation errors in the "Custsupport.html", "Main.html", and "Upsell.htm" components can be exploited to inject arbitrary code into the RealOneActiveXObject process and load unsafe controls.
22) A boundary error in the parsing of cook-specific data used for initialization can be exploited to cause a heap-based buffer overflow.
23) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to cause a heap-based buffer overflow via an invalid size for an embedded MDPR chunk.
24) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to corrupt heap memory via an invalid number streams within the chunk.
25) An input validation error when parsing the RMX file format can be exploited to cause a heap-based buffer overflow.
26) An error when decoding data for particular mime types within a RealMedia file can be exploited to cause a heap-based buffer overflow.
27) An error in the parsing of server headers can be exploited to cause a heap-based buffer overflow via an image tag pointing to a malicious server, which causes the player to fetch a remote file.
28) An error in the implementation of the Advanced Audio Coding compression when decoding a conditional component of a data block within an AAC frame can be exploited to corrupt memory.
Successful exploitation of the vulnerabilities may allow execution of arbitrary code.
SOLUTION: Upgrade to RealPlayer 14.0.0 or later.
PROVIDED AND/OR DISCOVERED BY: 1, 2) Alin Rad Pop, Secunia Research. 3) Carsten Eiram, Secunia Research. 4) Anonymous and Hossein Lotfi, reported via ZDI. 5 - 11, 20, 21) Anonymous, reported via ZDI. 12 - 14) The vendor credits Nicolas Joly, Vupen 15) The vendor credits Chaouki Bekrar, Vupen 17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs 18, 19) Omair, reported via iDefense. 22, 28) Damian Put, reported via ZDI. 23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team lollersk8erz. 25) Sebastian Apelt, reported via ZDI. 26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. 27) AbdulAziz Hariri, reported via ZDI.
ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2010-9/ http://secunia.com/secunia_research/2010-14/ http://secunia.com/secunia_research/2010-15/
RealNetworks: http://service.real.com/realplayer/security/12102010_player/en/ http://realnetworksblog.com/?p=2216
ZDI: http://www.zerodayinitiative.com/advisories/ZDI-10-268/ http://www.zerodayinitiative.com/advisories/ZDI-10-266/ http://www.zerodayinitiative.com/advisories/ZDI-10-270/ http://www.zerodayinitiative.com/advisories/ZDI-10-273/ http://www.zerodayinitiative.com/advisories/ZDI-10-269/ http://www.zerodayinitiative.com/advisories/ZDI-10-271/ http://www.zerodayinitiative.com/advisories/ZDI-10-272/ http://www.zerodayinitiative.com/advisories/ZDI-10-274/ http://www.zerodayinitiative.com/advisories/ZDI-10-275/ http://www.zerodayinitiative.com/advisories/ZDI-10-276/ http://www.zerodayinitiative.com/advisories/ZDI-10-277/ http://www.zerodayinitiative.com/advisories/ZDI-10-278/ http://www.zerodayinitiative.com/advisories/ZDI-10-279/ http://www.zerodayinitiative.com/advisories/ZDI-10-281/ http://www.zerodayinitiative.com/advisories/ZDI-10-280/ http://www.zerodayinitiative.com/advisories/ZDI-10-282/ http://www.zerodayinitiative.com/advisories/ZDI-10-267/
TippingPoint DVLabs: http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html
iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
.
====================================================================== 2) Severity
Rating: Highly critical Impact: System access Where: From remote
====================================================================== 3) Vendor's Description of Software
"RealPlayer\xae SP lets you download video from thousands of Websites \x96 free! Just click on the "download this video" button above the video you want. It's just that easy. Now you can watch your favorite videos anywhere, anytime."
Product Link: http://www.real.com/realplayer/
====================================================================== 4) Description of Vulnerability
Secunia Research has discovered a vulnerability in RealPlayer, which can be exploited by malicious people to potentially compromise a user's system.
====================================================================== 6) Time Table
26/02/2010 - Vendor notified. 01/03/2010 - Vendor response. 11/03/2010 - Vendor provides status update. 19/10/2010 - Vendor provides status update. 29/11/2010 - Vendor provides status update. 10/12/2010 - Public disclosure.
====================================================================== 8) References
The Common Vulnerabilities and Exposures (CVE) project has assigned CVE-2010-2579 for the vulnerability.
====================================================================== 9) About Secunia
Secunia offers vulnerability management solutions to corporate customers with verified and reliable vulnerability intelligence relevant to their specific system configuration:
http://secunia.com/advisories/business_solutions/
Secunia also provides a publicly accessible and comprehensive advisory database as a service to the security community and private individuals, who are interested in or concerned about IT-security.
http://secunia.com/advisories/
Secunia believes that it is important to support the community and to do active vulnerability research in order to aid improving the security and reliability of software in general:
http://secunia.com/secunia_research/
Secunia regularly hires new skilled team members. Check the URL below to see currently vacant positions:
http://secunia.com/corporate/jobs/
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/advisories/mailing_lists/
====================================================================== 10) Verification
Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2010-14/
Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/
======================================================================
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201012-0204",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.1.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.1.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.1.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.2"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "(enterprise) 2.1.2"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0.2.1744 (linux)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0 to 1.0.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.2 to 1.1.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.1.2 to 1.1.4"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1.4"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0.5"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0.2"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0.1"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1.3"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1.2"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1.1"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1"
},
{
"model": "networks realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.1"
},
{
"model": "networks realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.2.1744"
},
{
"model": "networks realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "2.1.2"
},
{
"model": "networks realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.7"
},
{
"model": "networks realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.6"
},
{
"model": "networks realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.5"
},
{
"model": "networks realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.2"
},
{
"model": "networks realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1"
},
{
"model": "networks realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "real",
"version": null
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.1.3114"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.9"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.8"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.7"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.6"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.5"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.4"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.3"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.2"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.1"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "10"
},
{
"model": "networks realplayer sp",
"scope": "ne",
"trust": 0.3,
"vendor": "real",
"version": "1.1.5"
},
{
"model": "networks realplayer for mac",
"scope": "ne",
"trust": 0.3,
"vendor": "real",
"version": "12.0.0.1548"
},
{
"model": "networks realplayer for linux",
"scope": "ne",
"trust": 0.3,
"vendor": "real",
"version": "11.0.2.2315"
},
{
"model": "networks realplayer enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "real",
"version": "2.1.3"
},
{
"model": "networks realplayer enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "real",
"version": "2.1.4"
},
{
"model": "networks realplayer",
"scope": "ne",
"trust": 0.3,
"vendor": "real",
"version": "14.0.1"
}
],
"sources": [
{
"db": "BID",
"id": "45463"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002591"
},
{
"db": "NVD",
"id": "CVE-2010-2579"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-165"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-2579"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Alin Rad Pop, Secunia Research",
"sources": [
{
"db": "BID",
"id": "45463"
}
],
"trust": 0.3
},
"cve": "CVE-2010-2579",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.0,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2010-2579",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-45184",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-2579",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201012-165",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-45184",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-45184"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002591"
},
{
"db": "NVD",
"id": "CVE-2010-2579"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-165"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The cook codec in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, RealPlayer Enterprise 2.1.2, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 does not properly initialize the number of channels, which allows attackers to obtain unspecified \"memory access\" via unknown vectors. Real Networks RealPlayer is prone to a memory-access vulnerability. Successful exploits may allow attackers to gain access to sensitive information, cause a denial-of-service condition or memory corruption. RealPlayer is a software package released and maintained by Real Networks, which can be used to play multimedia files encoded in Real Media format. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nRequest a free trial: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38550\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/38550/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nRELEASE DATE:\n2010-12-12\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/38550/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/38550/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in RealPlayer, which can\nbe exploited by malicious people to compromise a user\u0027s system. \n\n1) An error exists when parsing RealAudio content encoded using the\n\"cook\" codec. This can be exploited to trigger the use of\nuninitialised memory and potentially cause a memory corruption via\ne.g. a specially crafted RealMedia file. \n\n2) An error in the handling of errors encountered while decoding\n\"cook\"-encoded audio content can be exploited to trigger the use of\nuninitialised memory and potentially free an arbitrary address. \n\n3) An error in the parsing of AAC audio content can be exploited to\ncorrupt memory via specially crafted spectral data. \n\n4) An array indexing error when parsing Media Properties Header\n(MDPR) in a RealMedia file can be exploited to corrupt memory. \n\n5) An input validation error when parsing a RealMedia file can be\nexploited to cause a buffer overflow via a specially crafted\nmulti-rate audio stream. \n\n6) An error in the processing of the \"StreamTitle\" tag in a SHOUTcast\nstream using the ICY protocol can be exploited to cause an allocation\nfailure for heap memory, which can result in the usage of freed\npointers. \n\n7) An integer overflow error when parsing a MLLT atom in an .AAC file\ncan be exploited to cause a buffer overflow. \n\n8) An input validation error in the \"pnen3260.dll\" module in the\nparsing of TIT2 atoms within AAC files can be exploited to corrupt\nmemory. \n\n9) An integer overflow in the parsing of GIF87a files over the\nstreaming protocol RTSP can be exploited to cause a buffer overflow\nvia a large \"Screen Width\" size in the \"Screen Descriptor\" header. \n\n10) An error in the parsing of audio codec information in a Real\nAudio media file can be exploited to to cause a heap-based buffer\noverflow via a large number of subbands. \n\n11) An input validation error in drv2.dll when decompressing RV20\nvideo streams can be exploited to corrupt heap memory. \n\n12) An unspecified error related to \"SIPR\" parsing can be exploited\nto corrupt heap memory. \n\n13) An unspecified error related to \"SOUND\" processing can be\nexploited to corrupt heap memory. \n\n14) An unspecified error related to \"AAC\" processing can be exploited\nto corrupt heap memory. \n\n15) An unspecified error related to \"RealMedia\" processing can be\nexploited to corrupt heap memory. \n\n16) An unspecified error related to \"RA5\" processing can be exploited\nto corrupt heap memory. \n\n17) An integer overflow in \"drv1.dll\" when parsing SIPR stream\nmetadata can be exploited to cause a heap-based buffer overflow, e.g. \nvia the RealPlayer ActiveX control. \n\n18) An input validation error in the processing of RealMedia files\ncan be exploited to corrupt heap memory. \n\n19) An input validation error in the RealAudio codec when processing\nRealMedia files can be exploited to corrupt heap memory. \n\n20) An error in the \"HandleAction\" method in the RealPlayer ActiveX\ncontrol allows users to download and execute scripts in the \"Local\nZone\". \n\n21) Input sanitisation errors in the \"Custsupport.html\", \"Main.html\",\nand \"Upsell.htm\" components can be exploited to inject arbitrary code\ninto the RealOneActiveXObject process and load unsafe controls. \n\n22) A boundary error in the parsing of cook-specific data used for\ninitialization can be exploited to cause a heap-based buffer\noverflow. \n\n23) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to cause a heap-based\nbuffer overflow via an invalid size for an embedded MDPR chunk. \n\n24) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to corrupt heap memory\nvia an invalid number streams within the chunk. \n\n25) An input validation error when parsing the RMX file format can be\nexploited to cause a heap-based buffer overflow. \n\n26) An error when decoding data for particular mime types within a\nRealMedia file can be exploited to cause a heap-based buffer\noverflow. \n\n27) An error in the parsing of server headers can be exploited to\ncause a heap-based buffer overflow via an image tag pointing to a\nmalicious server, which causes the player to fetch a remote file. \n\n28) An error in the implementation of the Advanced Audio Coding\ncompression when decoding a conditional component of a data block\nwithin an AAC frame can be exploited to corrupt memory. \n\nSuccessful exploitation of the vulnerabilities may allow execution of\narbitrary code. \n\nSOLUTION:\nUpgrade to RealPlayer 14.0.0 or later. \n\nPROVIDED AND/OR DISCOVERED BY:\n1, 2) Alin Rad Pop, Secunia Research. \n3) Carsten Eiram, Secunia Research. \n4) Anonymous and Hossein Lotfi, reported via ZDI. \n5 - 11, 20, 21) Anonymous, reported via ZDI. \n12 - 14) The vendor credits Nicolas Joly, Vupen\n15) The vendor credits Chaouki Bekrar, Vupen\n17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs\n18, 19) Omair, reported via iDefense. \n22, 28) Damian Put, reported via ZDI. \n23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team\nlollersk8erz. \n25) Sebastian Apelt, reported via ZDI. \n26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. \n27) AbdulAziz Hariri, reported via ZDI. \n\nORIGINAL ADVISORY:\nSecunia Research:\nhttp://secunia.com/secunia_research/2010-9/\nhttp://secunia.com/secunia_research/2010-14/\nhttp://secunia.com/secunia_research/2010-15/\n\nRealNetworks:\nhttp://service.real.com/realplayer/security/12102010_player/en/\nhttp://realnetworksblog.com/?p=2216\n\nZDI:\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-268/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-266/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-270/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-273/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-269/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-271/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-272/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-274/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-275/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-276/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-277/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-278/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-279/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-281/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-280/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-282/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-267/\n\nTippingPoint DVLabs:\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html\n\niDefense Labs:\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\n====================================================================== \n2) Severity \n\nRating: Highly critical\nImpact: System access\nWhere: From remote\n\n====================================================================== \n3) Vendor\u0027s Description of Software \n\n\"RealPlayer\\xae SP lets you download video from thousands of Websites \n\\x96 free! Just click on the \"download this video\" button above the video \nyou want. It\u0027s just that easy. Now you can watch your favorite videos \nanywhere, anytime.\"\n\nProduct Link:\nhttp://www.real.com/realplayer/\n\n====================================================================== \n4) Description of Vulnerability\n\nSecunia Research has discovered a vulnerability in RealPlayer, which \ncan be exploited by malicious people to potentially compromise a \nuser\u0027s system. \n\n====================================================================== \n6) Time Table \n\n26/02/2010 - Vendor notified. \n01/03/2010 - Vendor response. \n11/03/2010 - Vendor provides status update. \n19/10/2010 - Vendor provides status update. \n29/11/2010 - Vendor provides status update. \n10/12/2010 - Public disclosure. \n\n====================================================================== \n8) References\n\nThe Common Vulnerabilities and Exposures (CVE) project has assigned\nCVE-2010-2579 for the vulnerability. \n\n====================================================================== \n9) About Secunia\n\nSecunia offers vulnerability management solutions to corporate\ncustomers with verified and reliable vulnerability intelligence\nrelevant to their specific system configuration:\n\nhttp://secunia.com/advisories/business_solutions/\n\nSecunia also provides a publicly accessible and comprehensive advisory\ndatabase as a service to the security community and private \nindividuals, who are interested in or concerned about IT-security. \n\nhttp://secunia.com/advisories/\n\nSecunia believes that it is important to support the community and to\ndo active vulnerability research in order to aid improving the \nsecurity and reliability of software in general:\n\nhttp://secunia.com/secunia_research/\n\nSecunia regularly hires new skilled team members. Check the URL below\nto see currently vacant positions:\n\nhttp://secunia.com/corporate/jobs/\n\nSecunia offers a FREE mailing list called Secunia Security Advisories:\n\nhttp://secunia.com/advisories/mailing_lists/\n\n====================================================================== \n10) Verification \n\nPlease verify this advisory by visiting the Secunia website:\nhttp://secunia.com/secunia_research/2010-14/\n\nComplete list of vulnerability reports published by Secunia Research:\nhttp://secunia.com/secunia_research/\n\n======================================================================\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-2579"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002591"
},
{
"db": "BID",
"id": "45463"
},
{
"db": "VULHUB",
"id": "VHN-45184"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96826"
},
{
"db": "PACKETSTORM",
"id": "96637"
}
],
"trust": 2.34
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-45184",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-45184"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-2579",
"trust": 2.9
},
{
"db": "SECUNIA",
"id": "38550",
"trust": 1.6
},
{
"db": "SECUNIA",
"id": "42565",
"trust": 1.5
},
{
"db": "SECTRACK",
"id": "1024861",
"trust": 1.1
},
{
"db": "VUPEN",
"id": "ADV-2010-3190",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002591",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201012-165",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "42333",
"trust": 0.7
},
{
"db": "BID",
"id": "45463",
"trust": 0.4
},
{
"db": "PACKETSTORM",
"id": "96826",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-45184",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-268",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-273",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-272",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-267",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-276",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-269",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-280",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-282",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-278",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-277",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-271",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-274",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-266",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-281",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-279",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-270",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-275",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96639",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96637",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-45184"
},
{
"db": "BID",
"id": "45463"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002591"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96826"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-2579"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-165"
}
]
},
"id": "VAR-201012-0204",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-45184"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:10:58.300000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/ja"
},
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/en"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002591"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002591"
},
{
"db": "NVD",
"id": "CVE-2010-2579"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/38550"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/42565"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id?1024861"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2579"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-2579"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2010/3190"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/42333"
},
{
"trust": 0.3,
"url": "http://realnetworksblog.com/?p=2192"
},
{
"trust": 0.3,
"url": "http://www.real.com/"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/blog/2010/12/09/realnetworks-patches-27-vulnerabilities"
},
{
"trust": 0.3,
"url": "/archive/1/515366"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.3,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.3,
"url": "http://realnetworksblog.com/?p=2216"
},
{
"trust": 0.2,
"url": "http://secunia.com/secunia_research/2010-14/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276/"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-15/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-9/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/#comments"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42333"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42333/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42333/#comments"
},
{
"trust": 0.1,
"url": "http://www.real.com/realplayer/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/"
},
{
"trust": 0.1,
"url": "http://secunia.com/corporate/jobs/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/mailing_lists/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/business_solutions/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2579"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42565"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-45184"
},
{
"db": "BID",
"id": "45463"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002591"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96826"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-2579"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-165"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-45184"
},
{
"db": "BID",
"id": "45463"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002591"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96826"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-2579"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-165"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-14T00:00:00",
"db": "VULHUB",
"id": "VHN-45184"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45463"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002591"
},
{
"date": "2010-12-13T04:13:47",
"db": "PACKETSTORM",
"id": "96636"
},
{
"date": "2010-12-13T04:13:55",
"db": "PACKETSTORM",
"id": "96639"
},
{
"date": "2010-12-20T21:10:17",
"db": "PACKETSTORM",
"id": "96826"
},
{
"date": "2010-12-13T04:13:50",
"db": "PACKETSTORM",
"id": "96637"
},
{
"date": "2010-12-14T16:00:02.867000",
"db": "NVD",
"id": "CVE-2010-2579"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-165"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-01-19T00:00:00",
"db": "VULHUB",
"id": "VHN-45184"
},
{
"date": "2010-12-20T15:24:00",
"db": "BID",
"id": "45463"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002591"
},
{
"date": "2011-01-19T06:59:00.913000",
"db": "NVD",
"id": "CVE-2010-2579"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-165"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-165"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer of cook Codec arbitrary memory access vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002591"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-165"
}
],
"trust": 0.6
}
}
VAR-201012-0240
Vulnerability from variot - Updated: 2023-12-18 12:10Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, RealPlayer Enterprise 2.1.2, Mac RealPlayer 11.0 through 11.1, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to have an unspecified impact via a crafted SIPR file. RealNetworks RealPlayer Is SIPR A heap overflow vulnerability exists.Details of the impact of this vulnerability are unknown. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition. NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. Remote attackers can use specially crafted SIPR files to cause unspecified effects. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial: http://secunia.com/products/corporate/vim/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38550
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/38550/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
RELEASE DATE: 2010-12-12
DISCUSS ADVISORY: http://secunia.com/advisories/38550/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/38550/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system.
1) An error exists when parsing RealAudio content encoded using the "cook" codec. This can be exploited to trigger the use of uninitialised memory and potentially cause a memory corruption via e.g. a specially crafted RealMedia file.
2) An error in the handling of errors encountered while decoding "cook"-encoded audio content can be exploited to trigger the use of uninitialised memory and potentially free an arbitrary address.
3) An error in the parsing of AAC audio content can be exploited to corrupt memory via specially crafted spectral data.
4) An array indexing error when parsing Media Properties Header (MDPR) in a RealMedia file can be exploited to corrupt memory.
5) An input validation error when parsing a RealMedia file can be exploited to cause a buffer overflow via a specially crafted multi-rate audio stream.
6) An error in the processing of the "StreamTitle" tag in a SHOUTcast stream using the ICY protocol can be exploited to cause an allocation failure for heap memory, which can result in the usage of freed pointers.
7) An integer overflow error when parsing a MLLT atom in an .AAC file can be exploited to cause a buffer overflow.
8) An input validation error in the "pnen3260.dll" module in the parsing of TIT2 atoms within AAC files can be exploited to corrupt memory.
9) An integer overflow in the parsing of GIF87a files over the streaming protocol RTSP can be exploited to cause a buffer overflow via a large "Screen Width" size in the "Screen Descriptor" header.
10) An error in the parsing of audio codec information in a Real Audio media file can be exploited to to cause a heap-based buffer overflow via a large number of subbands.
11) An input validation error in drv2.dll when decompressing RV20 video streams can be exploited to corrupt heap memory.
12) An unspecified error related to "SIPR" parsing can be exploited to corrupt heap memory.
13) An unspecified error related to "SOUND" processing can be exploited to corrupt heap memory.
14) An unspecified error related to "AAC" processing can be exploited to corrupt heap memory.
15) An unspecified error related to "RealMedia" processing can be exploited to corrupt heap memory.
16) An unspecified error related to "RA5" processing can be exploited to corrupt heap memory.
17) An integer overflow in "drv1.dll" when parsing SIPR stream metadata can be exploited to cause a heap-based buffer overflow, e.g. via the RealPlayer ActiveX control.
18) An input validation error in the processing of RealMedia files can be exploited to corrupt heap memory.
19) An input validation error in the RealAudio codec when processing RealMedia files can be exploited to corrupt heap memory.
20) An error in the "HandleAction" method in the RealPlayer ActiveX control allows users to download and execute scripts in the "Local Zone".
21) Input sanitisation errors in the "Custsupport.html", "Main.html", and "Upsell.htm" components can be exploited to inject arbitrary code into the RealOneActiveXObject process and load unsafe controls.
22) A boundary error in the parsing of cook-specific data used for initialization can be exploited to cause a heap-based buffer overflow.
23) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to cause a heap-based buffer overflow via an invalid size for an embedded MDPR chunk.
24) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to corrupt heap memory via an invalid number streams within the chunk.
25) An input validation error when parsing the RMX file format can be exploited to cause a heap-based buffer overflow.
26) An error when decoding data for particular mime types within a RealMedia file can be exploited to cause a heap-based buffer overflow.
27) An error in the parsing of server headers can be exploited to cause a heap-based buffer overflow via an image tag pointing to a malicious server, which causes the player to fetch a remote file.
28) An error in the implementation of the Advanced Audio Coding compression when decoding a conditional component of a data block within an AAC frame can be exploited to corrupt memory.
SOLUTION: Upgrade to RealPlayer 14.0.0 or later.
PROVIDED AND/OR DISCOVERED BY: 1, 2) Alin Rad Pop, Secunia Research. 3) Carsten Eiram, Secunia Research. 4) Anonymous and Hossein Lotfi, reported via ZDI. 5 - 11, 20, 21) Anonymous, reported via ZDI. 12 - 14) The vendor credits Nicolas Joly, Vupen 15) The vendor credits Chaouki Bekrar, Vupen 17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs 18, 19) Omair, reported via iDefense. 22, 28) Damian Put, reported via ZDI. 23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team lollersk8erz. 25) Sebastian Apelt, reported via ZDI. 26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. 27) AbdulAziz Hariri, reported via ZDI.
ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2010-9/ http://secunia.com/secunia_research/2010-14/ http://secunia.com/secunia_research/2010-15/
RealNetworks: http://service.real.com/realplayer/security/12102010_player/en/ http://realnetworksblog.com/?p=2216
ZDI: http://www.zerodayinitiative.com/advisories/ZDI-10-268/ http://www.zerodayinitiative.com/advisories/ZDI-10-266/ http://www.zerodayinitiative.com/advisories/ZDI-10-270/ http://www.zerodayinitiative.com/advisories/ZDI-10-273/ http://www.zerodayinitiative.com/advisories/ZDI-10-269/ http://www.zerodayinitiative.com/advisories/ZDI-10-271/ http://www.zerodayinitiative.com/advisories/ZDI-10-272/ http://www.zerodayinitiative.com/advisories/ZDI-10-274/ http://www.zerodayinitiative.com/advisories/ZDI-10-275/ http://www.zerodayinitiative.com/advisories/ZDI-10-276/ http://www.zerodayinitiative.com/advisories/ZDI-10-277/ http://www.zerodayinitiative.com/advisories/ZDI-10-278/ http://www.zerodayinitiative.com/advisories/ZDI-10-279/ http://www.zerodayinitiative.com/advisories/ZDI-10-281/ http://www.zerodayinitiative.com/advisories/ZDI-10-280/ http://www.zerodayinitiative.com/advisories/ZDI-10-282/ http://www.zerodayinitiative.com/advisories/ZDI-10-267/
TippingPoint DVLabs: http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html
iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201012-0240",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "1.1.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "2.1.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1.3"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "(enterprise) 2.1.2"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0.2.1744 (linux)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0 to 1.0.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.2 to 1.1.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.1.2 to 1.1.4"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (es)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.0"
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.2"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "116.0.14.550"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer for linux",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.0.2.2315"
},
{
"model": "realplayer enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.4"
},
{
"model": "realplayer",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "14.0.1"
}
],
"sources": [
{
"db": "BID",
"id": "45421"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002593"
},
{
"db": "NVD",
"id": "CVE-2010-4379"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-156"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:2.1.2:*:enterprise:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4379"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Nicolas Joly of VUPEN Vulnerability Research Team",
"sources": [
{
"db": "BID",
"id": "45421"
}
],
"trust": 0.3
},
"cve": "CVE-2010-4379",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-4379",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-46984",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-4379",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201012-156",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-46984",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46984"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002593"
},
{
"db": "NVD",
"id": "CVE-2010-4379"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-156"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, RealPlayer Enterprise 2.1.2, Mac RealPlayer 11.0 through 11.1, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to have an unspecified impact via a crafted SIPR file. RealNetworks RealPlayer Is SIPR A heap overflow vulnerability exists.Details of the impact of this vulnerability are unknown. \nSuccessfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition. \nNOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. Remote attackers can use specially crafted SIPR files to cause unspecified effects. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nRequest a free trial: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38550\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/38550/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nRELEASE DATE:\n2010-12-12\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/38550/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/38550/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in RealPlayer, which can\nbe exploited by malicious people to compromise a user\u0027s system. \n\n1) An error exists when parsing RealAudio content encoded using the\n\"cook\" codec. This can be exploited to trigger the use of\nuninitialised memory and potentially cause a memory corruption via\ne.g. a specially crafted RealMedia file. \n\n2) An error in the handling of errors encountered while decoding\n\"cook\"-encoded audio content can be exploited to trigger the use of\nuninitialised memory and potentially free an arbitrary address. \n\n3) An error in the parsing of AAC audio content can be exploited to\ncorrupt memory via specially crafted spectral data. \n\n4) An array indexing error when parsing Media Properties Header\n(MDPR) in a RealMedia file can be exploited to corrupt memory. \n\n5) An input validation error when parsing a RealMedia file can be\nexploited to cause a buffer overflow via a specially crafted\nmulti-rate audio stream. \n\n6) An error in the processing of the \"StreamTitle\" tag in a SHOUTcast\nstream using the ICY protocol can be exploited to cause an allocation\nfailure for heap memory, which can result in the usage of freed\npointers. \n\n7) An integer overflow error when parsing a MLLT atom in an .AAC file\ncan be exploited to cause a buffer overflow. \n\n8) An input validation error in the \"pnen3260.dll\" module in the\nparsing of TIT2 atoms within AAC files can be exploited to corrupt\nmemory. \n\n9) An integer overflow in the parsing of GIF87a files over the\nstreaming protocol RTSP can be exploited to cause a buffer overflow\nvia a large \"Screen Width\" size in the \"Screen Descriptor\" header. \n\n10) An error in the parsing of audio codec information in a Real\nAudio media file can be exploited to to cause a heap-based buffer\noverflow via a large number of subbands. \n\n11) An input validation error in drv2.dll when decompressing RV20\nvideo streams can be exploited to corrupt heap memory. \n\n12) An unspecified error related to \"SIPR\" parsing can be exploited\nto corrupt heap memory. \n\n13) An unspecified error related to \"SOUND\" processing can be\nexploited to corrupt heap memory. \n\n14) An unspecified error related to \"AAC\" processing can be exploited\nto corrupt heap memory. \n\n15) An unspecified error related to \"RealMedia\" processing can be\nexploited to corrupt heap memory. \n\n16) An unspecified error related to \"RA5\" processing can be exploited\nto corrupt heap memory. \n\n17) An integer overflow in \"drv1.dll\" when parsing SIPR stream\nmetadata can be exploited to cause a heap-based buffer overflow, e.g. \nvia the RealPlayer ActiveX control. \n\n18) An input validation error in the processing of RealMedia files\ncan be exploited to corrupt heap memory. \n\n19) An input validation error in the RealAudio codec when processing\nRealMedia files can be exploited to corrupt heap memory. \n\n20) An error in the \"HandleAction\" method in the RealPlayer ActiveX\ncontrol allows users to download and execute scripts in the \"Local\nZone\". \n\n21) Input sanitisation errors in the \"Custsupport.html\", \"Main.html\",\nand \"Upsell.htm\" components can be exploited to inject arbitrary code\ninto the RealOneActiveXObject process and load unsafe controls. \n\n22) A boundary error in the parsing of cook-specific data used for\ninitialization can be exploited to cause a heap-based buffer\noverflow. \n\n23) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to cause a heap-based\nbuffer overflow via an invalid size for an embedded MDPR chunk. \n\n24) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to corrupt heap memory\nvia an invalid number streams within the chunk. \n\n25) An input validation error when parsing the RMX file format can be\nexploited to cause a heap-based buffer overflow. \n\n26) An error when decoding data for particular mime types within a\nRealMedia file can be exploited to cause a heap-based buffer\noverflow. \n\n27) An error in the parsing of server headers can be exploited to\ncause a heap-based buffer overflow via an image tag pointing to a\nmalicious server, which causes the player to fetch a remote file. \n\n28) An error in the implementation of the Advanced Audio Coding\ncompression when decoding a conditional component of a data block\nwithin an AAC frame can be exploited to corrupt memory. \n\nSOLUTION:\nUpgrade to RealPlayer 14.0.0 or later. \n\nPROVIDED AND/OR DISCOVERED BY:\n1, 2) Alin Rad Pop, Secunia Research. \n3) Carsten Eiram, Secunia Research. \n4) Anonymous and Hossein Lotfi, reported via ZDI. \n5 - 11, 20, 21) Anonymous, reported via ZDI. \n12 - 14) The vendor credits Nicolas Joly, Vupen\n15) The vendor credits Chaouki Bekrar, Vupen\n17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs\n18, 19) Omair, reported via iDefense. \n22, 28) Damian Put, reported via ZDI. \n23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team\nlollersk8erz. \n25) Sebastian Apelt, reported via ZDI. \n26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. \n27) AbdulAziz Hariri, reported via ZDI. \n\nORIGINAL ADVISORY:\nSecunia Research:\nhttp://secunia.com/secunia_research/2010-9/\nhttp://secunia.com/secunia_research/2010-14/\nhttp://secunia.com/secunia_research/2010-15/\n\nRealNetworks:\nhttp://service.real.com/realplayer/security/12102010_player/en/\nhttp://realnetworksblog.com/?p=2216\n\nZDI:\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-268/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-266/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-270/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-273/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-269/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-271/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-272/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-274/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-275/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-276/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-277/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-278/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-279/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-281/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-280/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-282/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-267/\n\nTippingPoint DVLabs:\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html\n\niDefense Labs:\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4379"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002593"
},
{
"db": "BID",
"id": "45421"
},
{
"db": "VULHUB",
"id": "VHN-46984"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96637"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-4379",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "38550",
"trust": 1.6
},
{
"db": "SECUNIA",
"id": "42565",
"trust": 1.5
},
{
"db": "SECTRACK",
"id": "1024861",
"trust": 1.1
},
{
"db": "VUPEN",
"id": "ADV-2010-3190",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002593",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201012-156",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "42333",
"trust": 0.7
},
{
"db": "BID",
"id": "45421",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-46984",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-268",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-273",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-272",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-267",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-276",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-269",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-280",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-282",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-278",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-277",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-271",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-274",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-266",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-281",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-279",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-270",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-275",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96639",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96637",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46984"
},
{
"db": "BID",
"id": "45421"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002593"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4379"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-156"
}
]
},
"id": "VAR-201012-0240",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-46984"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:10:58.685000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/ja"
},
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/en"
},
{
"title": "RHSA-2010:0981",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2010-0981.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002593"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46984"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002593"
},
{
"db": "NVD",
"id": "CVE-2010-4379"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/38550"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/42565"
},
{
"trust": 1.1,
"url": "http://www.redhat.com/support/errata/rhsa-2010-0981.html"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id?1024861"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4379"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-4379"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2010/3190"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/42333"
},
{
"trust": 0.3,
"url": "http://realnetworksblog.com/?p=2192"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/blog/2010/12/09/realnetworks-patches-27-vulnerabilities"
},
{
"trust": 0.3,
"url": "http://www.real.com/"
},
{
"trust": 0.3,
"url": "/archive/1/515236"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.3,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.3,
"url": "http://realnetworksblog.com/?p=2216"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-14/"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-15/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-9/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/#comments"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42333"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42333/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42333/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42565"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46984"
},
{
"db": "BID",
"id": "45421"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002593"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4379"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-156"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-46984"
},
{
"db": "BID",
"id": "45421"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002593"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4379"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-156"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-14T00:00:00",
"db": "VULHUB",
"id": "VHN-46984"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45421"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002593"
},
{
"date": "2010-12-13T04:13:47",
"db": "PACKETSTORM",
"id": "96636"
},
{
"date": "2010-12-13T04:13:55",
"db": "PACKETSTORM",
"id": "96639"
},
{
"date": "2010-12-13T04:13:50",
"db": "PACKETSTORM",
"id": "96637"
},
{
"date": "2010-12-14T16:00:04.460000",
"db": "NVD",
"id": "CVE-2010-4379"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-156"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-01-26T00:00:00",
"db": "VULHUB",
"id": "VHN-46984"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45421"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002593"
},
{
"date": "2011-01-26T06:52:15.053000",
"db": "NVD",
"id": "CVE-2010-4379"
},
{
"date": "2011-07-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-156"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-156"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer In SIPR Heap overflow vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002593"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-156"
}
],
"trust": 0.6
}
}
VAR-201012-0320
Vulnerability from variot - Updated: 2023-12-18 12:10Integer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.0.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a malformed MLLT atom in an AAC file. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. The application utilizes a size specified in this data structure for allocation of a list of objects. To calculate the size for the allocation, the application will multiply this length by 8. If the multiplication results in a value greater than 32 bits an integer overflow will occur. When copying data into this buffer heap corruption will occur which can lead to code execution under the context of the currently logged in user. Real Networks RealPlayer is prone to an integer-overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. This issue affects Windows RealPlayer SP 1.0.1 and prior, Mac RealPlayer 11.1.0.1116 and prior, Linux RealPlayer 11.0.2.1744 and prior. NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial: http://secunia.com/products/corporate/vim/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38550
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/38550/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
RELEASE DATE: 2010-12-12
DISCUSS ADVISORY: http://secunia.com/advisories/38550/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/38550/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system.
1) An error exists when parsing RealAudio content encoded using the "cook" codec. This can be exploited to trigger the use of uninitialised memory and potentially cause a memory corruption via e.g. a specially crafted RealMedia file.
2) An error in the handling of errors encountered while decoding "cook"-encoded audio content can be exploited to trigger the use of uninitialised memory and potentially free an arbitrary address.
3) An error in the parsing of AAC audio content can be exploited to corrupt memory via specially crafted spectral data.
4) An array indexing error when parsing Media Properties Header (MDPR) in a RealMedia file can be exploited to corrupt memory.
5) An input validation error when parsing a RealMedia file can be exploited to cause a buffer overflow via a specially crafted multi-rate audio stream.
6) An error in the processing of the "StreamTitle" tag in a SHOUTcast stream using the ICY protocol can be exploited to cause an allocation failure for heap memory, which can result in the usage of freed pointers.
8) An input validation error in the "pnen3260.dll" module in the parsing of TIT2 atoms within AAC files can be exploited to corrupt memory.
9) An integer overflow in the parsing of GIF87a files over the streaming protocol RTSP can be exploited to cause a buffer overflow via a large "Screen Width" size in the "Screen Descriptor" header.
10) An error in the parsing of audio codec information in a Real Audio media file can be exploited to to cause a heap-based buffer overflow via a large number of subbands.
11) An input validation error in drv2.dll when decompressing RV20 video streams can be exploited to corrupt heap memory.
12) An unspecified error related to "SIPR" parsing can be exploited to corrupt heap memory.
13) An unspecified error related to "SOUND" processing can be exploited to corrupt heap memory.
14) An unspecified error related to "AAC" processing can be exploited to corrupt heap memory.
15) An unspecified error related to "RealMedia" processing can be exploited to corrupt heap memory.
16) An unspecified error related to "RA5" processing can be exploited to corrupt heap memory.
17) An integer overflow in "drv1.dll" when parsing SIPR stream metadata can be exploited to cause a heap-based buffer overflow, e.g. via the RealPlayer ActiveX control.
18) An input validation error in the processing of RealMedia files can be exploited to corrupt heap memory.
19) An input validation error in the RealAudio codec when processing RealMedia files can be exploited to corrupt heap memory.
20) An error in the "HandleAction" method in the RealPlayer ActiveX control allows users to download and execute scripts in the "Local Zone".
21) Input sanitisation errors in the "Custsupport.html", "Main.html", and "Upsell.htm" components can be exploited to inject arbitrary code into the RealOneActiveXObject process and load unsafe controls.
22) A boundary error in the parsing of cook-specific data used for initialization can be exploited to cause a heap-based buffer overflow.
23) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to cause a heap-based buffer overflow via an invalid size for an embedded MDPR chunk.
24) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to corrupt heap memory via an invalid number streams within the chunk.
25) An input validation error when parsing the RMX file format can be exploited to cause a heap-based buffer overflow.
26) An error when decoding data for particular mime types within a RealMedia file can be exploited to cause a heap-based buffer overflow.
27) An error in the parsing of server headers can be exploited to cause a heap-based buffer overflow via an image tag pointing to a malicious server, which causes the player to fetch a remote file.
28) An error in the implementation of the Advanced Audio Coding compression when decoding a conditional component of a data block within an AAC frame can be exploited to corrupt memory.
SOLUTION: Upgrade to RealPlayer 14.0.0 or later.
PROVIDED AND/OR DISCOVERED BY: 1, 2) Alin Rad Pop, Secunia Research. 3) Carsten Eiram, Secunia Research. 4) Anonymous and Hossein Lotfi, reported via ZDI. 5 - 11, 20, 21) Anonymous, reported via ZDI. 12 - 14) The vendor credits Nicolas Joly, Vupen 15) The vendor credits Chaouki Bekrar, Vupen 17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs 18, 19) Omair, reported via iDefense. 22, 28) Damian Put, reported via ZDI. 23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team lollersk8erz. 25) Sebastian Apelt, reported via ZDI. 26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. 27) AbdulAziz Hariri, reported via ZDI.
ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2010-9/ http://secunia.com/secunia_research/2010-14/ http://secunia.com/secunia_research/2010-15/
RealNetworks: http://service.real.com/realplayer/security/12102010_player/en/ http://realnetworksblog.com/?p=2216
ZDI: http://www.zerodayinitiative.com/advisories/ZDI-10-268/ http://www.zerodayinitiative.com/advisories/ZDI-10-266/ http://www.zerodayinitiative.com/advisories/ZDI-10-270/ http://www.zerodayinitiative.com/advisories/ZDI-10-273/ http://www.zerodayinitiative.com/advisories/ZDI-10-269/ http://www.zerodayinitiative.com/advisories/ZDI-10-271/ http://www.zerodayinitiative.com/advisories/ZDI-10-272/ http://www.zerodayinitiative.com/advisories/ZDI-10-274/ http://www.zerodayinitiative.com/advisories/ZDI-10-275/ http://www.zerodayinitiative.com/advisories/ZDI-10-276/ http://www.zerodayinitiative.com/advisories/ZDI-10-277/ http://www.zerodayinitiative.com/advisories/ZDI-10-278/ http://www.zerodayinitiative.com/advisories/ZDI-10-279/ http://www.zerodayinitiative.com/advisories/ZDI-10-281/ http://www.zerodayinitiative.com/advisories/ZDI-10-280/ http://www.zerodayinitiative.com/advisories/ZDI-10-282/ http://www.zerodayinitiative.com/advisories/ZDI-10-267/
TippingPoint DVLabs: http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html
iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. ZDI-10-273: RealNetworks RealPlayer AAC MLLT Atom Parsing Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-10-273
December 10, 2010
-- CVE ID: CVE-2010-2999
-- CVSS: 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)
-- Affected Vendors: RealNetworks
-- Affected Products: RealNetworks RealPlayer
-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 8415.
-- Vendor Response: RealNetworks has issued an update to correct this vulnerability. More details can be found at:
http://service.real.com/realplayer/security/12102010_player/en/
-- Disclosure Timeline: 2009-08-20 - Vulnerability reported to vendor 2010-12-10 - Coordinated public release of advisory
-- Credit: This vulnerability was discovered by: * Anonymous
-- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201012-0320",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer sp",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0.2.1744 (linux)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0 to 1.0.1"
},
{
"model": "realplayer",
"scope": null,
"trust": 0.7,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "116.0.14.550"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer for mac",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "12.0.0.1548"
},
{
"model": "realplayer for linux",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0.2.2315"
},
{
"model": "realplayer",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "14.0.1"
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.3"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.3"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.4"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-273"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45409"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002585"
},
{
"db": "NVD",
"id": "CVE-2010-2999"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-163"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-2999"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Anonymous",
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-273"
},
{
"db": "BID",
"id": "45409"
}
],
"trust": 1.0
},
"cve": "CVE-2010-2999",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-2999",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2010-2999",
"impactScore": 8.5,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-45604",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-2999",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2010-2999",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201012-163",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-45604",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-273"
},
{
"db": "VULHUB",
"id": "VHN-45604"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002585"
},
{
"db": "NVD",
"id": "CVE-2010-2999"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-163"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Integer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.0.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a malformed MLLT atom in an AAC file. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. The application utilizes a size specified in this data structure for allocation of a list of objects. To calculate the size for the allocation, the application will multiply this length by 8. If the multiplication results in a value greater than 32 bits an integer overflow will occur. When copying data into this buffer heap corruption will occur which can lead to code execution under the context of the currently logged in user. Real Networks RealPlayer is prone to an integer-overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. \nThis issue affects Windows RealPlayer SP 1.0.1 and prior, Mac RealPlayer 11.1.0.1116 and prior, Linux RealPlayer 11.0.2.1744 and prior. \nNOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nRequest a free trial: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38550\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/38550/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nRELEASE DATE:\n2010-12-12\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/38550/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/38550/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in RealPlayer, which can\nbe exploited by malicious people to compromise a user\u0027s system. \n\n1) An error exists when parsing RealAudio content encoded using the\n\"cook\" codec. This can be exploited to trigger the use of\nuninitialised memory and potentially cause a memory corruption via\ne.g. a specially crafted RealMedia file. \n\n2) An error in the handling of errors encountered while decoding\n\"cook\"-encoded audio content can be exploited to trigger the use of\nuninitialised memory and potentially free an arbitrary address. \n\n3) An error in the parsing of AAC audio content can be exploited to\ncorrupt memory via specially crafted spectral data. \n\n4) An array indexing error when parsing Media Properties Header\n(MDPR) in a RealMedia file can be exploited to corrupt memory. \n\n5) An input validation error when parsing a RealMedia file can be\nexploited to cause a buffer overflow via a specially crafted\nmulti-rate audio stream. \n\n6) An error in the processing of the \"StreamTitle\" tag in a SHOUTcast\nstream using the ICY protocol can be exploited to cause an allocation\nfailure for heap memory, which can result in the usage of freed\npointers. \n\n8) An input validation error in the \"pnen3260.dll\" module in the\nparsing of TIT2 atoms within AAC files can be exploited to corrupt\nmemory. \n\n9) An integer overflow in the parsing of GIF87a files over the\nstreaming protocol RTSP can be exploited to cause a buffer overflow\nvia a large \"Screen Width\" size in the \"Screen Descriptor\" header. \n\n10) An error in the parsing of audio codec information in a Real\nAudio media file can be exploited to to cause a heap-based buffer\noverflow via a large number of subbands. \n\n11) An input validation error in drv2.dll when decompressing RV20\nvideo streams can be exploited to corrupt heap memory. \n\n12) An unspecified error related to \"SIPR\" parsing can be exploited\nto corrupt heap memory. \n\n13) An unspecified error related to \"SOUND\" processing can be\nexploited to corrupt heap memory. \n\n14) An unspecified error related to \"AAC\" processing can be exploited\nto corrupt heap memory. \n\n15) An unspecified error related to \"RealMedia\" processing can be\nexploited to corrupt heap memory. \n\n16) An unspecified error related to \"RA5\" processing can be exploited\nto corrupt heap memory. \n\n17) An integer overflow in \"drv1.dll\" when parsing SIPR stream\nmetadata can be exploited to cause a heap-based buffer overflow, e.g. \nvia the RealPlayer ActiveX control. \n\n18) An input validation error in the processing of RealMedia files\ncan be exploited to corrupt heap memory. \n\n19) An input validation error in the RealAudio codec when processing\nRealMedia files can be exploited to corrupt heap memory. \n\n20) An error in the \"HandleAction\" method in the RealPlayer ActiveX\ncontrol allows users to download and execute scripts in the \"Local\nZone\". \n\n21) Input sanitisation errors in the \"Custsupport.html\", \"Main.html\",\nand \"Upsell.htm\" components can be exploited to inject arbitrary code\ninto the RealOneActiveXObject process and load unsafe controls. \n\n22) A boundary error in the parsing of cook-specific data used for\ninitialization can be exploited to cause a heap-based buffer\noverflow. \n\n23) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to cause a heap-based\nbuffer overflow via an invalid size for an embedded MDPR chunk. \n\n24) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to corrupt heap memory\nvia an invalid number streams within the chunk. \n\n25) An input validation error when parsing the RMX file format can be\nexploited to cause a heap-based buffer overflow. \n\n26) An error when decoding data for particular mime types within a\nRealMedia file can be exploited to cause a heap-based buffer\noverflow. \n\n27) An error in the parsing of server headers can be exploited to\ncause a heap-based buffer overflow via an image tag pointing to a\nmalicious server, which causes the player to fetch a remote file. \n\n28) An error in the implementation of the Advanced Audio Coding\ncompression when decoding a conditional component of a data block\nwithin an AAC frame can be exploited to corrupt memory. \n\nSOLUTION:\nUpgrade to RealPlayer 14.0.0 or later. \n\nPROVIDED AND/OR DISCOVERED BY:\n1, 2) Alin Rad Pop, Secunia Research. \n3) Carsten Eiram, Secunia Research. \n4) Anonymous and Hossein Lotfi, reported via ZDI. \n5 - 11, 20, 21) Anonymous, reported via ZDI. \n12 - 14) The vendor credits Nicolas Joly, Vupen\n15) The vendor credits Chaouki Bekrar, Vupen\n17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs\n18, 19) Omair, reported via iDefense. \n22, 28) Damian Put, reported via ZDI. \n23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team\nlollersk8erz. \n25) Sebastian Apelt, reported via ZDI. \n26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. \n27) AbdulAziz Hariri, reported via ZDI. \n\nORIGINAL ADVISORY:\nSecunia Research:\nhttp://secunia.com/secunia_research/2010-9/\nhttp://secunia.com/secunia_research/2010-14/\nhttp://secunia.com/secunia_research/2010-15/\n\nRealNetworks:\nhttp://service.real.com/realplayer/security/12102010_player/en/\nhttp://realnetworksblog.com/?p=2216\n\nZDI:\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-268/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-266/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-270/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-273/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-269/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-271/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-272/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-274/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-275/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-276/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-277/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-278/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-279/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-281/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-280/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-282/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-267/\n\nTippingPoint DVLabs:\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html\n\niDefense Labs:\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. ZDI-10-273: RealNetworks RealPlayer AAC MLLT Atom Parsing Remote Code Execution Vulnerability\n\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-273\n\nDecember 10, 2010\n\n-- CVE ID:\nCVE-2010-2999\n\n-- CVSS:\n9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)\n\n-- Affected Vendors:\nRealNetworks\n\n-- Affected Products:\nRealNetworks RealPlayer\n\n-- TippingPoint(TM) IPS Customer Protection:\nTippingPoint IPS customers have been protected against this\nvulnerability by Digital Vaccine protection filter ID 8415. \n\n-- Vendor Response:\nRealNetworks has issued an update to correct this vulnerability. More\ndetails can be found at:\n\nhttp://service.real.com/realplayer/security/12102010_player/en/\n\n-- Disclosure Timeline:\n2009-08-20 - Vulnerability reported to vendor\n2010-12-10 - Coordinated public release of advisory\n\n-- Credit:\nThis vulnerability was discovered by:\n * Anonymous\n\n-- About the Zero Day Initiative (ZDI):\nEstablished by TippingPoint, The Zero Day Initiative (ZDI) represents\na best-of-breed model for rewarding security researchers for responsibly\ndisclosing discovered vulnerabilities. \n\nResearchers interested in getting paid for their security research\nthrough the ZDI can find more information and sign-up at:\n\n http://www.zerodayinitiative.com\n\nThe ZDI is unique in how the acquired vulnerability information is\nused. TippingPoint does not re-sell the vulnerability details or any\nexploit code. Instead, upon notifying the affected product vendor,\nTippingPoint provides its customers with zero day protection through\nits intrusion prevention technology. Explicit details regarding the\nspecifics of the vulnerability are not exposed to any parties until\nan official vendor patch is publicly available. Furthermore, with the\naltruistic aim of helping to secure a broader user base, TippingPoint\nprovides this vulnerability information confidentially to security\nvendors (including competitors) who have a vulnerability protection or\nmitigation product. \n\nOur vulnerability disclosure policy is available online at:\n\n http://www.zerodayinitiative.com/advisories/disclosure_policy/\n\nFollow the ZDI on Twitter:\n\n http://twitter.com/thezdi\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-2999"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002585"
},
{
"db": "ZDI",
"id": "ZDI-10-273"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45409"
},
{
"db": "VULHUB",
"id": "VHN-45604"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96595"
},
{
"db": "PACKETSTORM",
"id": "96637"
}
],
"trust": 3.15
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-45604",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-45604"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-2999",
"trust": 3.6
},
{
"db": "ZDI",
"id": "ZDI-10-273",
"trust": 3.2
},
{
"db": "SECUNIA",
"id": "38550",
"trust": 1.6
},
{
"db": "SECUNIA",
"id": "42565",
"trust": 1.5
},
{
"db": "SECTRACK",
"id": "1024861",
"trust": 1.1
},
{
"db": "VUPEN",
"id": "ADV-2010-3190",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002585",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-569",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201012-163",
"trust": 0.7
},
{
"db": "BID",
"id": "45409",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-266",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-280",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-267",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-269",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-277",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-272",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-268",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-274",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-271",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-276",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-278",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-279",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-282",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-270",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-275",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-281",
"trust": 0.4
},
{
"db": "BID",
"id": "45327",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "96595",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-45604",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96637",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-273"
},
{
"db": "VULHUB",
"id": "VHN-45604"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45409"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002585"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96595"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-2999"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-163"
}
]
},
"id": "VAR-201012-0320",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-45604"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:10:58.989000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/ja"
},
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/en"
},
{
"title": "RealNetworks has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"title": "RealPlayerSP",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35884"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35883"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35882"
},
{
"title": "RealPlayer",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35881"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-273"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002585"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-163"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-189",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-45604"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002585"
},
{
"db": "NVD",
"id": "CVE-2010-2999"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"trust": 2.4,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/38550"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/42565"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id?1024861"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2999"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-2999"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2010/3190"
},
{
"trust": 0.6,
"url": "http://realnetworksblog.com/?p=2192"
},
{
"trust": 0.6,
"url": "http://dvlabs.tippingpoint.com/blog/2010/12/09/realnetworks-patches-27-vulnerabilities"
},
{
"trust": 0.6,
"url": "http://www.real.com/"
},
{
"trust": 0.6,
"url": "http://service.real.com/realplay8er/security/12102010_player/en/"
},
{
"trust": 0.4,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883"
},
{
"trust": 0.4,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884"
},
{
"trust": 0.3,
"url": "/archive/1/515235"
},
{
"trust": 0.3,
"url": "/archive/1/515236"
},
{
"trust": 0.3,
"url": "/archive/1/515238"
},
{
"trust": 0.3,
"url": "/archive/1/515237"
},
{
"trust": 0.3,
"url": "/archive/1/515234"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/advisory/tpti-10-18"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/advisory/tpti-10-19"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282"
},
{
"trust": 0.2,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.2,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.2,
"url": "http://realnetworksblog.com/?p=2216"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-14/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-15/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-9/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/#comments"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/disclosure_policy/"
},
{
"trust": 0.1,
"url": "http://twitter.com/thezdi"
},
{
"trust": 0.1,
"url": "http://www.tippingpoint.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2999"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42565"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-273"
},
{
"db": "VULHUB",
"id": "VHN-45604"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45409"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002585"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96595"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-2999"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-163"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-10-273"
},
{
"db": "VULHUB",
"id": "VHN-45604"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45409"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002585"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96595"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-2999"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-163"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-10T00:00:00",
"db": "ZDI",
"id": "ZDI-10-273"
},
{
"date": "2010-12-14T00:00:00",
"db": "VULHUB",
"id": "VHN-45604"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45327"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45409"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002585"
},
{
"date": "2010-12-13T04:13:47",
"db": "PACKETSTORM",
"id": "96636"
},
{
"date": "2010-12-11T15:18:50",
"db": "PACKETSTORM",
"id": "96595"
},
{
"date": "2010-12-13T04:13:50",
"db": "PACKETSTORM",
"id": "96637"
},
{
"date": "2010-12-14T16:00:02.960000",
"db": "NVD",
"id": "CVE-2010-2999"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-163"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-10T00:00:00",
"db": "ZDI",
"id": "ZDI-10-273"
},
{
"date": "2011-01-19T00:00:00",
"db": "VULHUB",
"id": "VHN-45604"
},
{
"date": "2010-12-16T22:14:00",
"db": "BID",
"id": "45327"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45409"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002585"
},
{
"date": "2011-01-19T06:59:42.130000",
"db": "NVD",
"id": "CVE-2010-2999"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-163"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45409"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer of AAC MLLT Atom Integer overflow vulnerability in analysis processing",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002585"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "digital error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-163"
}
],
"trust": 0.6
}
}
VAR-201012-0252
Vulnerability from variot - Updated: 2023-12-18 12:10Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, Mac RealPlayer 11.0 through 11.1, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code via malformed multi-rate data in an audio stream. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists when parsing a RealMedia file containing a malformed multi-rate audio stream. The application explicitly trusts two 16-bit values in this data structure which are then used to calculate the size used for an allocation. Real Networks released an advisory regarding 27 security vulnerabilities in RealPlayer. Real Networks RealPlayer is prone to heap overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. This issue affects Windows RealPlayer 11.1 and prior, Mac RealPlayer 11.1.0.1116 and prior, Linux RealPlayer 11.0.2.1744 and prior. NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial: http://secunia.com/products/corporate/vim/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38550
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/38550/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
RELEASE DATE: 2010-12-12
DISCUSS ADVISORY: http://secunia.com/advisories/38550/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/38550/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system.
1) An error exists when parsing RealAudio content encoded using the "cook" codec. This can be exploited to trigger the use of uninitialised memory and potentially cause a memory corruption via e.g. a specially crafted RealMedia file.
2) An error in the handling of errors encountered while decoding "cook"-encoded audio content can be exploited to trigger the use of uninitialised memory and potentially free an arbitrary address.
3) An error in the parsing of AAC audio content can be exploited to corrupt memory via specially crafted spectral data.
4) An array indexing error when parsing Media Properties Header (MDPR) in a RealMedia file can be exploited to corrupt memory.
6) An error in the processing of the "StreamTitle" tag in a SHOUTcast stream using the ICY protocol can be exploited to cause an allocation failure for heap memory, which can result in the usage of freed pointers.
7) An integer overflow error when parsing a MLLT atom in an .AAC file can be exploited to cause a buffer overflow.
8) An input validation error in the "pnen3260.dll" module in the parsing of TIT2 atoms within AAC files can be exploited to corrupt memory.
9) An integer overflow in the parsing of GIF87a files over the streaming protocol RTSP can be exploited to cause a buffer overflow via a large "Screen Width" size in the "Screen Descriptor" header.
10) An error in the parsing of audio codec information in a Real Audio media file can be exploited to to cause a heap-based buffer overflow via a large number of subbands.
11) An input validation error in drv2.dll when decompressing RV20 video streams can be exploited to corrupt heap memory.
12) An unspecified error related to "SIPR" parsing can be exploited to corrupt heap memory.
13) An unspecified error related to "SOUND" processing can be exploited to corrupt heap memory.
14) An unspecified error related to "AAC" processing can be exploited to corrupt heap memory.
15) An unspecified error related to "RealMedia" processing can be exploited to corrupt heap memory.
16) An unspecified error related to "RA5" processing can be exploited to corrupt heap memory.
17) An integer overflow in "drv1.dll" when parsing SIPR stream metadata can be exploited to cause a heap-based buffer overflow, e.g. via the RealPlayer ActiveX control.
18) An input validation error in the processing of RealMedia files can be exploited to corrupt heap memory.
19) An input validation error in the RealAudio codec when processing RealMedia files can be exploited to corrupt heap memory.
20) An error in the "HandleAction" method in the RealPlayer ActiveX control allows users to download and execute scripts in the "Local Zone".
21) Input sanitisation errors in the "Custsupport.html", "Main.html", and "Upsell.htm" components can be exploited to inject arbitrary code into the RealOneActiveXObject process and load unsafe controls.
23) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to cause a heap-based buffer overflow via an invalid size for an embedded MDPR chunk.
24) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to corrupt heap memory via an invalid number streams within the chunk.
25) An input validation error when parsing the RMX file format can be exploited to cause a heap-based buffer overflow.
27) An error in the parsing of server headers can be exploited to cause a heap-based buffer overflow via an image tag pointing to a malicious server, which causes the player to fetch a remote file.
28) An error in the implementation of the Advanced Audio Coding compression when decoding a conditional component of a data block within an AAC frame can be exploited to corrupt memory.
SOLUTION: Upgrade to RealPlayer 14.0.0 or later.
PROVIDED AND/OR DISCOVERED BY: 1, 2) Alin Rad Pop, Secunia Research. 3) Carsten Eiram, Secunia Research. 4) Anonymous and Hossein Lotfi, reported via ZDI. 5 - 11, 20, 21) Anonymous, reported via ZDI. 12 - 14) The vendor credits Nicolas Joly, Vupen 15) The vendor credits Chaouki Bekrar, Vupen 17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs 18, 19) Omair, reported via iDefense. 22, 28) Damian Put, reported via ZDI. 23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team lollersk8erz. 25) Sebastian Apelt, reported via ZDI. 26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. 27) AbdulAziz Hariri, reported via ZDI.
ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2010-9/ http://secunia.com/secunia_research/2010-14/ http://secunia.com/secunia_research/2010-15/
RealNetworks: http://service.real.com/realplayer/security/12102010_player/en/ http://realnetworksblog.com/?p=2216
ZDI: http://www.zerodayinitiative.com/advisories/ZDI-10-268/ http://www.zerodayinitiative.com/advisories/ZDI-10-266/ http://www.zerodayinitiative.com/advisories/ZDI-10-270/ http://www.zerodayinitiative.com/advisories/ZDI-10-273/ http://www.zerodayinitiative.com/advisories/ZDI-10-269/ http://www.zerodayinitiative.com/advisories/ZDI-10-271/ http://www.zerodayinitiative.com/advisories/ZDI-10-272/ http://www.zerodayinitiative.com/advisories/ZDI-10-274/ http://www.zerodayinitiative.com/advisories/ZDI-10-275/ http://www.zerodayinitiative.com/advisories/ZDI-10-276/ http://www.zerodayinitiative.com/advisories/ZDI-10-277/ http://www.zerodayinitiative.com/advisories/ZDI-10-278/ http://www.zerodayinitiative.com/advisories/ZDI-10-279/ http://www.zerodayinitiative.com/advisories/ZDI-10-281/ http://www.zerodayinitiative.com/advisories/ZDI-10-280/ http://www.zerodayinitiative.com/advisories/ZDI-10-282/ http://www.zerodayinitiative.com/advisories/ZDI-10-267/
TippingPoint DVLabs: http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html
iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. ZDI-10-266: RealNetworks RealPlayer Multi-Rate Audio Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-10-266
December 10, 2010
-- CVE ID: CVE-2010-4375
-- CVSS: 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)
-- Affected Vendors: RealNetworks
-- Affected Products: RealNetworks RealPlayer
-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 8441.
-- Vendor Response: RealNetworks has issued an update to correct this vulnerability. More details can be found at:
http://service.real.com/realplayer/security/12102010_player/en/
-- Disclosure Timeline: 2009-04-15 - Vulnerability reported to vendor 2010-12-10 - Coordinated public release of advisory
-- Credit: This vulnerability was discovered by: * Anonymous
-- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201012-0252",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0.2.1744 (linux)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (es)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.0"
},
{
"model": "realplayer",
"scope": null,
"trust": 0.7,
"vendor": "realnetworks",
"version": null
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "116.0.14.550"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer for mac",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "12.0.0.1548"
},
{
"model": "realplayer for linux",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0.2.2315"
},
{
"model": "realplayer",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "14.0.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.3"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.3"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.4"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-266"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45406"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002583"
},
{
"db": "NVD",
"id": "CVE-2010-4375"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-160"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4375"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Anonymous",
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-266"
},
{
"db": "BID",
"id": "45406"
}
],
"trust": 1.0
},
"cve": "CVE-2010-4375",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-4375",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2010-4375",
"impactScore": 8.5,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-46980",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-4375",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2010-4375",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201012-160",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-46980",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-266"
},
{
"db": "VULHUB",
"id": "VHN-46980"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002583"
},
{
"db": "NVD",
"id": "CVE-2010-4375"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-160"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, Mac RealPlayer 11.0 through 11.1, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code via malformed multi-rate data in an audio stream. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists when parsing a RealMedia file containing a malformed multi-rate audio stream. The application explicitly trusts two 16-bit values in this data structure which are then used to calculate the size used for an allocation. \nReal Networks released an advisory regarding 27 security vulnerabilities in RealPlayer. Real Networks RealPlayer is prone to heap overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. \nThis issue affects Windows RealPlayer 11.1 and prior, Mac RealPlayer 11.1.0.1116 and prior, Linux RealPlayer 11.0.2.1744 and prior. \nNOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nRequest a free trial: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38550\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/38550/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nRELEASE DATE:\n2010-12-12\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/38550/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/38550/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in RealPlayer, which can\nbe exploited by malicious people to compromise a user\u0027s system. \n\n1) An error exists when parsing RealAudio content encoded using the\n\"cook\" codec. This can be exploited to trigger the use of\nuninitialised memory and potentially cause a memory corruption via\ne.g. a specially crafted RealMedia file. \n\n2) An error in the handling of errors encountered while decoding\n\"cook\"-encoded audio content can be exploited to trigger the use of\nuninitialised memory and potentially free an arbitrary address. \n\n3) An error in the parsing of AAC audio content can be exploited to\ncorrupt memory via specially crafted spectral data. \n\n4) An array indexing error when parsing Media Properties Header\n(MDPR) in a RealMedia file can be exploited to corrupt memory. \n\n6) An error in the processing of the \"StreamTitle\" tag in a SHOUTcast\nstream using the ICY protocol can be exploited to cause an allocation\nfailure for heap memory, which can result in the usage of freed\npointers. \n\n7) An integer overflow error when parsing a MLLT atom in an .AAC file\ncan be exploited to cause a buffer overflow. \n\n8) An input validation error in the \"pnen3260.dll\" module in the\nparsing of TIT2 atoms within AAC files can be exploited to corrupt\nmemory. \n\n9) An integer overflow in the parsing of GIF87a files over the\nstreaming protocol RTSP can be exploited to cause a buffer overflow\nvia a large \"Screen Width\" size in the \"Screen Descriptor\" header. \n\n10) An error in the parsing of audio codec information in a Real\nAudio media file can be exploited to to cause a heap-based buffer\noverflow via a large number of subbands. \n\n11) An input validation error in drv2.dll when decompressing RV20\nvideo streams can be exploited to corrupt heap memory. \n\n12) An unspecified error related to \"SIPR\" parsing can be exploited\nto corrupt heap memory. \n\n13) An unspecified error related to \"SOUND\" processing can be\nexploited to corrupt heap memory. \n\n14) An unspecified error related to \"AAC\" processing can be exploited\nto corrupt heap memory. \n\n15) An unspecified error related to \"RealMedia\" processing can be\nexploited to corrupt heap memory. \n\n16) An unspecified error related to \"RA5\" processing can be exploited\nto corrupt heap memory. \n\n17) An integer overflow in \"drv1.dll\" when parsing SIPR stream\nmetadata can be exploited to cause a heap-based buffer overflow, e.g. \nvia the RealPlayer ActiveX control. \n\n18) An input validation error in the processing of RealMedia files\ncan be exploited to corrupt heap memory. \n\n19) An input validation error in the RealAudio codec when processing\nRealMedia files can be exploited to corrupt heap memory. \n\n20) An error in the \"HandleAction\" method in the RealPlayer ActiveX\ncontrol allows users to download and execute scripts in the \"Local\nZone\". \n\n21) Input sanitisation errors in the \"Custsupport.html\", \"Main.html\",\nand \"Upsell.htm\" components can be exploited to inject arbitrary code\ninto the RealOneActiveXObject process and load unsafe controls. \n\n23) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to cause a heap-based\nbuffer overflow via an invalid size for an embedded MDPR chunk. \n\n24) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to corrupt heap memory\nvia an invalid number streams within the chunk. \n\n25) An input validation error when parsing the RMX file format can be\nexploited to cause a heap-based buffer overflow. \n\n27) An error in the parsing of server headers can be exploited to\ncause a heap-based buffer overflow via an image tag pointing to a\nmalicious server, which causes the player to fetch a remote file. \n\n28) An error in the implementation of the Advanced Audio Coding\ncompression when decoding a conditional component of a data block\nwithin an AAC frame can be exploited to corrupt memory. \n\nSOLUTION:\nUpgrade to RealPlayer 14.0.0 or later. \n\nPROVIDED AND/OR DISCOVERED BY:\n1, 2) Alin Rad Pop, Secunia Research. \n3) Carsten Eiram, Secunia Research. \n4) Anonymous and Hossein Lotfi, reported via ZDI. \n5 - 11, 20, 21) Anonymous, reported via ZDI. \n12 - 14) The vendor credits Nicolas Joly, Vupen\n15) The vendor credits Chaouki Bekrar, Vupen\n17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs\n18, 19) Omair, reported via iDefense. \n22, 28) Damian Put, reported via ZDI. \n23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team\nlollersk8erz. \n25) Sebastian Apelt, reported via ZDI. \n26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. \n27) AbdulAziz Hariri, reported via ZDI. \n\nORIGINAL ADVISORY:\nSecunia Research:\nhttp://secunia.com/secunia_research/2010-9/\nhttp://secunia.com/secunia_research/2010-14/\nhttp://secunia.com/secunia_research/2010-15/\n\nRealNetworks:\nhttp://service.real.com/realplayer/security/12102010_player/en/\nhttp://realnetworksblog.com/?p=2216\n\nZDI:\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-268/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-266/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-270/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-273/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-269/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-271/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-272/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-274/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-275/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-276/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-277/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-278/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-279/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-281/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-280/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-282/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-267/\n\nTippingPoint DVLabs:\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html\n\niDefense Labs:\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. ZDI-10-266: RealNetworks RealPlayer Multi-Rate Audio Remote Code Execution Vulnerability\n\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-266\n\nDecember 10, 2010\n\n-- CVE ID:\nCVE-2010-4375\n\n-- CVSS:\n9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)\n\n-- Affected Vendors:\nRealNetworks\n\n-- Affected Products:\nRealNetworks RealPlayer\n\n-- TippingPoint(TM) IPS Customer Protection:\nTippingPoint IPS customers have been protected against this\nvulnerability by Digital Vaccine protection filter ID 8441. \n\n-- Vendor Response:\nRealNetworks has issued an update to correct this vulnerability. More\ndetails can be found at:\n\nhttp://service.real.com/realplayer/security/12102010_player/en/\n\n-- Disclosure Timeline:\n2009-04-15 - Vulnerability reported to vendor\n2010-12-10 - Coordinated public release of advisory\n\n-- Credit:\nThis vulnerability was discovered by:\n * Anonymous\n\n-- About the Zero Day Initiative (ZDI):\nEstablished by TippingPoint, The Zero Day Initiative (ZDI) represents\na best-of-breed model for rewarding security researchers for responsibly\ndisclosing discovered vulnerabilities. \n\nResearchers interested in getting paid for their security research\nthrough the ZDI can find more information and sign-up at:\n\n http://www.zerodayinitiative.com\n\nThe ZDI is unique in how the acquired vulnerability information is\nused. TippingPoint does not re-sell the vulnerability details or any\nexploit code. Instead, upon notifying the affected product vendor,\nTippingPoint provides its customers with zero day protection through\nits intrusion prevention technology. Explicit details regarding the\nspecifics of the vulnerability are not exposed to any parties until\nan official vendor patch is publicly available. Furthermore, with the\naltruistic aim of helping to secure a broader user base, TippingPoint\nprovides this vulnerability information confidentially to security\nvendors (including competitors) who have a vulnerability protection or\nmitigation product. \n\nOur vulnerability disclosure policy is available online at:\n\n http://www.zerodayinitiative.com/advisories/disclosure_policy/\n\nFollow the ZDI on Twitter:\n\n http://twitter.com/thezdi\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4375"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002583"
},
{
"db": "ZDI",
"id": "ZDI-10-266"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45406"
},
{
"db": "VULHUB",
"id": "VHN-46980"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96588"
},
{
"db": "PACKETSTORM",
"id": "96637"
}
],
"trust": 3.15
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-46980",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46980"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-4375",
"trust": 3.6
},
{
"db": "ZDI",
"id": "ZDI-10-266",
"trust": 3.2
},
{
"db": "SECUNIA",
"id": "38550",
"trust": 1.6
},
{
"db": "SECUNIA",
"id": "42565",
"trust": 1.5
},
{
"db": "SECTRACK",
"id": "1024861",
"trust": 1.1
},
{
"db": "VUPEN",
"id": "ADV-2010-3190",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002583",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-473",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201012-160",
"trust": 0.7
},
{
"db": "BID",
"id": "45406",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-273",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-280",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-267",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-269",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-277",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-272",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-268",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-274",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-271",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-276",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-278",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-279",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-282",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-270",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-275",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-281",
"trust": 0.4
},
{
"db": "BID",
"id": "45327",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "96588",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-46980",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96637",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-266"
},
{
"db": "VULHUB",
"id": "VHN-46980"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45406"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002583"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96588"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4375"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-160"
}
]
},
"id": "VAR-201012-0252",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-46980"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:10:58.727000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/ja"
},
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/en"
},
{
"title": "RHSA-2010:0981",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2010-0981.html"
},
{
"title": "RealNetworks has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-266"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002583"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46980"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002583"
},
{
"db": "NVD",
"id": "CVE-2010-4375"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"trust": 2.4,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/38550"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/42565"
},
{
"trust": 1.1,
"url": "http://www.redhat.com/support/errata/rhsa-2010-0981.html"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id?1024861"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4375"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-4375"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2010/3190"
},
{
"trust": 0.6,
"url": "http://realnetworksblog.com/?p=2192"
},
{
"trust": 0.6,
"url": "http://dvlabs.tippingpoint.com/blog/2010/12/09/realnetworks-patches-27-vulnerabilities"
},
{
"trust": 0.6,
"url": "http://www.real.com/"
},
{
"trust": 0.4,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883"
},
{
"trust": 0.4,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884"
},
{
"trust": 0.3,
"url": "/archive/1/515235"
},
{
"trust": 0.3,
"url": "/archive/1/515236"
},
{
"trust": 0.3,
"url": "/archive/1/515238"
},
{
"trust": 0.3,
"url": "/archive/1/515237"
},
{
"trust": 0.3,
"url": "/archive/1/515234"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/advisory/tpti-10-18"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/advisory/tpti-10-19"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282"
},
{
"trust": 0.2,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.2,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.2,
"url": "http://realnetworksblog.com/?p=2216"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-14/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-15/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-9/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/#comments"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/disclosure_policy/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-4375"
},
{
"trust": 0.1,
"url": "http://twitter.com/thezdi"
},
{
"trust": 0.1,
"url": "http://www.tippingpoint.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42565"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-266"
},
{
"db": "VULHUB",
"id": "VHN-46980"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45406"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002583"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96588"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4375"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-160"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-10-266"
},
{
"db": "VULHUB",
"id": "VHN-46980"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45406"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002583"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96588"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4375"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-160"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-10T00:00:00",
"db": "ZDI",
"id": "ZDI-10-266"
},
{
"date": "2010-12-14T00:00:00",
"db": "VULHUB",
"id": "VHN-46980"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45327"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45406"
},
{
"date": "2011-01-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002583"
},
{
"date": "2010-12-13T04:13:47",
"db": "PACKETSTORM",
"id": "96636"
},
{
"date": "2010-12-11T15:16:06",
"db": "PACKETSTORM",
"id": "96588"
},
{
"date": "2010-12-13T04:13:50",
"db": "PACKETSTORM",
"id": "96637"
},
{
"date": "2010-12-14T16:00:04.303000",
"db": "NVD",
"id": "CVE-2010-4375"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-160"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-10T00:00:00",
"db": "ZDI",
"id": "ZDI-10-266"
},
{
"date": "2011-01-26T00:00:00",
"db": "VULHUB",
"id": "VHN-46980"
},
{
"date": "2010-12-16T22:14:00",
"db": "BID",
"id": "45327"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45406"
},
{
"date": "2011-01-06T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002583"
},
{
"date": "2011-01-26T06:52:14.600000",
"db": "NVD",
"id": "CVE-2010-4375"
},
{
"date": "2011-07-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-160"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45406"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer Multi-rate audio heap-based buffer overflow vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002583"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-160"
}
],
"trust": 0.6
}
}
VAR-201012-0015
Vulnerability from variot - Updated: 2023-12-18 12:10RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, RealPlayer Enterprise 2.1.2, and Mac RealPlayer 11.0 through 12.0.0.1444 do not properly parse spectral data in AAC files, which has unspecified impact and remote attack vectors. Real Networks RealPlayer is prone to a memory corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealPlayer is a software package released and maintained by Real Networks, which can be used to play multimedia files encoded in Real Media format. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial: http://secunia.com/products/corporate/vim/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38550
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/38550/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
RELEASE DATE: 2010-12-12
DISCUSS ADVISORY: http://secunia.com/advisories/38550/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/38550/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system.
1) An error exists when parsing RealAudio content encoded using the "cook" codec. This can be exploited to trigger the use of uninitialised memory and potentially cause a memory corruption via e.g. a specially crafted RealMedia file.
2) An error in the handling of errors encountered while decoding "cook"-encoded audio content can be exploited to trigger the use of uninitialised memory and potentially free an arbitrary address.
3) An error in the parsing of AAC audio content can be exploited to corrupt memory via specially crafted spectral data.
4) An array indexing error when parsing Media Properties Header (MDPR) in a RealMedia file can be exploited to corrupt memory.
5) An input validation error when parsing a RealMedia file can be exploited to cause a buffer overflow via a specially crafted multi-rate audio stream.
6) An error in the processing of the "StreamTitle" tag in a SHOUTcast stream using the ICY protocol can be exploited to cause an allocation failure for heap memory, which can result in the usage of freed pointers.
7) An integer overflow error when parsing a MLLT atom in an .AAC file can be exploited to cause a buffer overflow.
8) An input validation error in the "pnen3260.dll" module in the parsing of TIT2 atoms within AAC files can be exploited to corrupt memory.
9) An integer overflow in the parsing of GIF87a files over the streaming protocol RTSP can be exploited to cause a buffer overflow via a large "Screen Width" size in the "Screen Descriptor" header.
10) An error in the parsing of audio codec information in a Real Audio media file can be exploited to to cause a heap-based buffer overflow via a large number of subbands.
11) An input validation error in drv2.dll when decompressing RV20 video streams can be exploited to corrupt heap memory.
12) An unspecified error related to "SIPR" parsing can be exploited to corrupt heap memory.
13) An unspecified error related to "SOUND" processing can be exploited to corrupt heap memory.
14) An unspecified error related to "AAC" processing can be exploited to corrupt heap memory.
15) An unspecified error related to "RealMedia" processing can be exploited to corrupt heap memory.
16) An unspecified error related to "RA5" processing can be exploited to corrupt heap memory.
17) An integer overflow in "drv1.dll" when parsing SIPR stream metadata can be exploited to cause a heap-based buffer overflow, e.g. via the RealPlayer ActiveX control.
18) An input validation error in the processing of RealMedia files can be exploited to corrupt heap memory.
19) An input validation error in the RealAudio codec when processing RealMedia files can be exploited to corrupt heap memory.
20) An error in the "HandleAction" method in the RealPlayer ActiveX control allows users to download and execute scripts in the "Local Zone".
21) Input sanitisation errors in the "Custsupport.html", "Main.html", and "Upsell.htm" components can be exploited to inject arbitrary code into the RealOneActiveXObject process and load unsafe controls.
22) A boundary error in the parsing of cook-specific data used for initialization can be exploited to cause a heap-based buffer overflow.
23) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to cause a heap-based buffer overflow via an invalid size for an embedded MDPR chunk.
24) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to corrupt heap memory via an invalid number streams within the chunk.
25) An input validation error when parsing the RMX file format can be exploited to cause a heap-based buffer overflow.
26) An error when decoding data for particular mime types within a RealMedia file can be exploited to cause a heap-based buffer overflow.
27) An error in the parsing of server headers can be exploited to cause a heap-based buffer overflow via an image tag pointing to a malicious server, which causes the player to fetch a remote file.
28) An error in the implementation of the Advanced Audio Coding compression when decoding a conditional component of a data block within an AAC frame can be exploited to corrupt memory.
Successful exploitation of the vulnerabilities may allow execution of arbitrary code.
SOLUTION: Upgrade to RealPlayer 14.0.0 or later.
PROVIDED AND/OR DISCOVERED BY: 1, 2) Alin Rad Pop, Secunia Research. 3) Carsten Eiram, Secunia Research. 4) Anonymous and Hossein Lotfi, reported via ZDI. 5 - 11, 20, 21) Anonymous, reported via ZDI. 12 - 14) The vendor credits Nicolas Joly, Vupen 15) The vendor credits Chaouki Bekrar, Vupen 17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs 18, 19) Omair, reported via iDefense. 22, 28) Damian Put, reported via ZDI. 23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team lollersk8erz. 25) Sebastian Apelt, reported via ZDI. 26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. 27) AbdulAziz Hariri, reported via ZDI.
ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2010-9/ http://secunia.com/secunia_research/2010-14/ http://secunia.com/secunia_research/2010-15/
RealNetworks: http://service.real.com/realplayer/security/12102010_player/en/ http://realnetworksblog.com/?p=2216
ZDI: http://www.zerodayinitiative.com/advisories/ZDI-10-268/ http://www.zerodayinitiative.com/advisories/ZDI-10-266/ http://www.zerodayinitiative.com/advisories/ZDI-10-270/ http://www.zerodayinitiative.com/advisories/ZDI-10-273/ http://www.zerodayinitiative.com/advisories/ZDI-10-269/ http://www.zerodayinitiative.com/advisories/ZDI-10-271/ http://www.zerodayinitiative.com/advisories/ZDI-10-272/ http://www.zerodayinitiative.com/advisories/ZDI-10-274/ http://www.zerodayinitiative.com/advisories/ZDI-10-275/ http://www.zerodayinitiative.com/advisories/ZDI-10-276/ http://www.zerodayinitiative.com/advisories/ZDI-10-277/ http://www.zerodayinitiative.com/advisories/ZDI-10-278/ http://www.zerodayinitiative.com/advisories/ZDI-10-279/ http://www.zerodayinitiative.com/advisories/ZDI-10-281/ http://www.zerodayinitiative.com/advisories/ZDI-10-280/ http://www.zerodayinitiative.com/advisories/ZDI-10-282/ http://www.zerodayinitiative.com/advisories/ZDI-10-267/
TippingPoint DVLabs: http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html
iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
.
====================================================================== 2) Severity
Rating: Highly critical Impact: System compromise Where: Remote
====================================================================== 3) Vendor's Description of Software
"RealPlayer\xae SP lets you download video from thousands of Websites \x96 free! Just click on the "download this video" button above the video you want. It's just that easy. Now you can watch your favorite videos anywhere, anytime."
Product Link: http://www.real.com/realplayer/
====================================================================== 4) Description of Vulnerability
Secunia Research has discovered a vulnerability in RealPlayer, which can be exploited by malicious people to compromise a user's system.
====================================================================== 6) Time Table
01/03/2010 - Vendor notified. 01/03/2010 - Vendor response. 11/03/2010 - Vendor provides status update. 19/10/2010 - Vendor provides status update. 29/11/2010 - Vendor provides status update. 10/12/2010 - Public disclosure.
====================================================================== 8) References
The Common Vulnerabilities and Exposures (CVE) project has assigned CVE-2010-0125 for the vulnerability.
====================================================================== 9) About Secunia
Secunia offers vulnerability management solutions to corporate customers with verified and reliable vulnerability intelligence relevant to their specific system configuration:
http://secunia.com/advisories/business_solutions/
Secunia also provides a publicly accessible and comprehensive advisory database as a service to the security community and private individuals, who are interested in or concerned about IT-security.
http://secunia.com/advisories/
Secunia believes that it is important to support the community and to do active vulnerability research in order to aid improving the security and reliability of software in general:
http://secunia.com/secunia_research/
Secunia regularly hires new skilled team members. Check the URL below to see currently vacant positions:
http://secunia.com/corporate/jobs/
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/advisories/mailing_lists/
====================================================================== 10) Verification
Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2010-15/
Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/
======================================================================
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201012-0015",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "2.1.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.0.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.1.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.1.3"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.1.4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.2"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "(enterprise) 2.1.2"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "12.0.0.1444 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0 to 1.0.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.2 to 1.1.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.1.2 to 1.1.4"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1.4"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0.5"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0.2"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0.1"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1.3"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1.2"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1.1"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1"
},
{
"model": "networks realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "12.0.0.1444"
},
{
"model": "networks realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.1"
},
{
"model": "networks realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0"
},
{
"model": "networks realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "2.1.2"
},
{
"model": "networks realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.7"
},
{
"model": "networks realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.6"
},
{
"model": "networks realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.5"
},
{
"model": "networks realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.2"
},
{
"model": "networks realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1"
},
{
"model": "networks realplayer beta",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "116.0.14.550"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.331"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.503"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.481"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.412"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.396"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.352"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.325"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.305"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "10"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.5"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.4"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.3"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.2"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.1"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.1"
},
{
"model": "networks realplayer beta",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11"
},
{
"model": "networks realplayer for mac",
"scope": "ne",
"trust": 0.3,
"vendor": "real",
"version": "12.0.0.1548"
},
{
"model": "networks realplayer enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "real",
"version": "2.1.3"
}
],
"sources": [
{
"db": "BID",
"id": "45455"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002592"
},
{
"db": "NVD",
"id": "CVE-2010-0125"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-166"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:12.0.0.1444:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:2.1.2:*:enterprise:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-0125"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Carsten Eiram of Secunia Research.",
"sources": [
{
"db": "BID",
"id": "45455"
}
],
"trust": 0.3
},
"cve": "CVE-2010-0125",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-0125",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-42730",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-0125",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201012-166",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-42730",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-42730"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002592"
},
{
"db": "NVD",
"id": "CVE-2010-0125"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-166"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, RealPlayer Enterprise 2.1.2, and Mac RealPlayer 11.0 through 12.0.0.1444 do not properly parse spectral data in AAC files, which has unspecified impact and remote attack vectors. Real Networks RealPlayer is prone to a memory corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. \nNOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealPlayer is a software package released and maintained by Real Networks, which can be used to play multimedia files encoded in Real Media format. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nRequest a free trial: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38550\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/38550/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nRELEASE DATE:\n2010-12-12\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/38550/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/38550/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in RealPlayer, which can\nbe exploited by malicious people to compromise a user\u0027s system. \n\n1) An error exists when parsing RealAudio content encoded using the\n\"cook\" codec. This can be exploited to trigger the use of\nuninitialised memory and potentially cause a memory corruption via\ne.g. a specially crafted RealMedia file. \n\n2) An error in the handling of errors encountered while decoding\n\"cook\"-encoded audio content can be exploited to trigger the use of\nuninitialised memory and potentially free an arbitrary address. \n\n3) An error in the parsing of AAC audio content can be exploited to\ncorrupt memory via specially crafted spectral data. \n\n4) An array indexing error when parsing Media Properties Header\n(MDPR) in a RealMedia file can be exploited to corrupt memory. \n\n5) An input validation error when parsing a RealMedia file can be\nexploited to cause a buffer overflow via a specially crafted\nmulti-rate audio stream. \n\n6) An error in the processing of the \"StreamTitle\" tag in a SHOUTcast\nstream using the ICY protocol can be exploited to cause an allocation\nfailure for heap memory, which can result in the usage of freed\npointers. \n\n7) An integer overflow error when parsing a MLLT atom in an .AAC file\ncan be exploited to cause a buffer overflow. \n\n8) An input validation error in the \"pnen3260.dll\" module in the\nparsing of TIT2 atoms within AAC files can be exploited to corrupt\nmemory. \n\n9) An integer overflow in the parsing of GIF87a files over the\nstreaming protocol RTSP can be exploited to cause a buffer overflow\nvia a large \"Screen Width\" size in the \"Screen Descriptor\" header. \n\n10) An error in the parsing of audio codec information in a Real\nAudio media file can be exploited to to cause a heap-based buffer\noverflow via a large number of subbands. \n\n11) An input validation error in drv2.dll when decompressing RV20\nvideo streams can be exploited to corrupt heap memory. \n\n12) An unspecified error related to \"SIPR\" parsing can be exploited\nto corrupt heap memory. \n\n13) An unspecified error related to \"SOUND\" processing can be\nexploited to corrupt heap memory. \n\n14) An unspecified error related to \"AAC\" processing can be exploited\nto corrupt heap memory. \n\n15) An unspecified error related to \"RealMedia\" processing can be\nexploited to corrupt heap memory. \n\n16) An unspecified error related to \"RA5\" processing can be exploited\nto corrupt heap memory. \n\n17) An integer overflow in \"drv1.dll\" when parsing SIPR stream\nmetadata can be exploited to cause a heap-based buffer overflow, e.g. \nvia the RealPlayer ActiveX control. \n\n18) An input validation error in the processing of RealMedia files\ncan be exploited to corrupt heap memory. \n\n19) An input validation error in the RealAudio codec when processing\nRealMedia files can be exploited to corrupt heap memory. \n\n20) An error in the \"HandleAction\" method in the RealPlayer ActiveX\ncontrol allows users to download and execute scripts in the \"Local\nZone\". \n\n21) Input sanitisation errors in the \"Custsupport.html\", \"Main.html\",\nand \"Upsell.htm\" components can be exploited to inject arbitrary code\ninto the RealOneActiveXObject process and load unsafe controls. \n\n22) A boundary error in the parsing of cook-specific data used for\ninitialization can be exploited to cause a heap-based buffer\noverflow. \n\n23) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to cause a heap-based\nbuffer overflow via an invalid size for an embedded MDPR chunk. \n\n24) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to corrupt heap memory\nvia an invalid number streams within the chunk. \n\n25) An input validation error when parsing the RMX file format can be\nexploited to cause a heap-based buffer overflow. \n\n26) An error when decoding data for particular mime types within a\nRealMedia file can be exploited to cause a heap-based buffer\noverflow. \n\n27) An error in the parsing of server headers can be exploited to\ncause a heap-based buffer overflow via an image tag pointing to a\nmalicious server, which causes the player to fetch a remote file. \n\n28) An error in the implementation of the Advanced Audio Coding\ncompression when decoding a conditional component of a data block\nwithin an AAC frame can be exploited to corrupt memory. \n\nSuccessful exploitation of the vulnerabilities may allow execution of\narbitrary code. \n\nSOLUTION:\nUpgrade to RealPlayer 14.0.0 or later. \n\nPROVIDED AND/OR DISCOVERED BY:\n1, 2) Alin Rad Pop, Secunia Research. \n3) Carsten Eiram, Secunia Research. \n4) Anonymous and Hossein Lotfi, reported via ZDI. \n5 - 11, 20, 21) Anonymous, reported via ZDI. \n12 - 14) The vendor credits Nicolas Joly, Vupen\n15) The vendor credits Chaouki Bekrar, Vupen\n17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs\n18, 19) Omair, reported via iDefense. \n22, 28) Damian Put, reported via ZDI. \n23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team\nlollersk8erz. \n25) Sebastian Apelt, reported via ZDI. \n26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. \n27) AbdulAziz Hariri, reported via ZDI. \n\nORIGINAL ADVISORY:\nSecunia Research:\nhttp://secunia.com/secunia_research/2010-9/\nhttp://secunia.com/secunia_research/2010-14/\nhttp://secunia.com/secunia_research/2010-15/\n\nRealNetworks:\nhttp://service.real.com/realplayer/security/12102010_player/en/\nhttp://realnetworksblog.com/?p=2216\n\nZDI:\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-268/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-266/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-270/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-273/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-269/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-271/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-272/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-274/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-275/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-276/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-277/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-278/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-279/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-281/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-280/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-282/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-267/\n\nTippingPoint DVLabs:\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html\n\niDefense Labs:\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\n====================================================================== \n2) Severity \n\nRating: Highly critical\nImpact: System compromise\nWhere: Remote\n\n====================================================================== \n3) Vendor\u0027s Description of Software \n\n\"RealPlayer\\xae SP lets you download video from thousands of Websites \n\\x96 free! Just click on the \"download this video\" button above the video \nyou want. It\u0027s just that easy. Now you can watch your favorite videos \nanywhere, anytime.\"\n\nProduct Link:\nhttp://www.real.com/realplayer/\n\n====================================================================== \n4) Description of Vulnerability\n\nSecunia Research has discovered a vulnerability in RealPlayer, which \ncan be exploited by malicious people to compromise a user\u0027s system. \n\n====================================================================== \n6) Time Table \n\n01/03/2010 - Vendor notified. \n01/03/2010 - Vendor response. \n11/03/2010 - Vendor provides status update. \n19/10/2010 - Vendor provides status update. \n29/11/2010 - Vendor provides status update. \n10/12/2010 - Public disclosure. \n\n====================================================================== \n8) References\n\nThe Common Vulnerabilities and Exposures (CVE) project has assigned \nCVE-2010-0125 for the vulnerability. \n\n====================================================================== \n9) About Secunia\n\nSecunia offers vulnerability management solutions to corporate\ncustomers with verified and reliable vulnerability intelligence\nrelevant to their specific system configuration:\n\nhttp://secunia.com/advisories/business_solutions/\n\nSecunia also provides a publicly accessible and comprehensive advisory\ndatabase as a service to the security community and private \nindividuals, who are interested in or concerned about IT-security. \n\nhttp://secunia.com/advisories/\n\nSecunia believes that it is important to support the community and to\ndo active vulnerability research in order to aid improving the \nsecurity and reliability of software in general:\n\nhttp://secunia.com/secunia_research/\n\nSecunia regularly hires new skilled team members. Check the URL below\nto see currently vacant positions:\n\nhttp://secunia.com/corporate/jobs/\n\nSecunia offers a FREE mailing list called Secunia Security Advisories:\n\nhttp://secunia.com/advisories/mailing_lists/\n\n====================================================================== \n10) Verification \n\nPlease verify this advisory by visiting the Secunia website:\nhttp://secunia.com/secunia_research/2010-15/\n\nComplete list of vulnerability reports published by Secunia Research:\nhttp://secunia.com/secunia_research/\n\n======================================================================\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-0125"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002592"
},
{
"db": "BID",
"id": "45455"
},
{
"db": "VULHUB",
"id": "VHN-42730"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96825"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96639"
}
],
"trust": 2.34
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-42730",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-42730"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-0125",
"trust": 2.9
},
{
"db": "SECUNIA",
"id": "38550",
"trust": 1.6
},
{
"db": "SECTRACK",
"id": "1024861",
"trust": 1.1
},
{
"db": "VUPEN",
"id": "ADV-2010-3190",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002592",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201012-166",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "42512",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "42333",
"trust": 0.7
},
{
"db": "BID",
"id": "45455",
"trust": 0.4
},
{
"db": "PACKETSTORM",
"id": "96825",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-42730",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-268",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-273",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-272",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-267",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-276",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-269",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-280",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-282",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-278",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-277",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-271",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-274",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-266",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-281",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-279",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-270",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-275",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96640",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96639",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-42730"
},
{
"db": "BID",
"id": "45455"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002592"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96825"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "NVD",
"id": "CVE-2010-0125"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-166"
}
]
},
"id": "VAR-201012-0015",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-42730"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:10:58.777000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/ja"
},
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/en"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002592"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-42730"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002592"
},
{
"db": "NVD",
"id": "CVE-2010-0125"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/38550"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id?1024861"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0125"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-0125"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2010/3190"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/42333"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/42512"
},
{
"trust": 0.3,
"url": "http://www.real.com/"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/blog/2010/12/09/realnetworks-patches-27-vulnerabilities"
},
{
"trust": 0.3,
"url": "/archive/1/515365"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.3,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.3,
"url": "http://realnetworksblog.com/?p=2216"
},
{
"trust": 0.2,
"url": "http://secunia.com/secunia_research/2010-15/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-14/"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-9/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/#comments"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280/"
},
{
"trust": 0.1,
"url": "http://www.real.com/realplayer/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/"
},
{
"trust": 0.1,
"url": "http://secunia.com/corporate/jobs/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/mailing_lists/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-0125"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/business_solutions/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42512/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42512"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42512/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42333"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42333/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42333/#comments"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-42730"
},
{
"db": "BID",
"id": "45455"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002592"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96825"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "NVD",
"id": "CVE-2010-0125"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-166"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-42730"
},
{
"db": "BID",
"id": "45455"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002592"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96825"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "NVD",
"id": "CVE-2010-0125"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-166"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-14T00:00:00",
"db": "VULHUB",
"id": "VHN-42730"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45455"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002592"
},
{
"date": "2010-12-13T04:13:47",
"db": "PACKETSTORM",
"id": "96636"
},
{
"date": "2010-12-20T21:08:43",
"db": "PACKETSTORM",
"id": "96825"
},
{
"date": "2010-12-13T04:13:58",
"db": "PACKETSTORM",
"id": "96640"
},
{
"date": "2010-12-13T04:13:55",
"db": "PACKETSTORM",
"id": "96639"
},
{
"date": "2010-12-14T16:00:02.820000",
"db": "NVD",
"id": "CVE-2010-0125"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-166"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-02-17T00:00:00",
"db": "VULHUB",
"id": "VHN-42730"
},
{
"date": "2010-12-20T15:14:00",
"db": "BID",
"id": "45455"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002592"
},
{
"date": "2011-02-17T05:00:00",
"db": "NVD",
"id": "CVE-2010-0125"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-166"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-166"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer of AAC Vulnerability in spectral data analysis processing",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002592"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-166"
}
],
"trust": 0.6
}
}
VAR-201012-0254
Vulnerability from variot - Updated: 2023-12-18 12:10Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, Mac RealPlayer 11.0 through 12.0.0.1444, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code by specifying many subbands in cook audio codec information in a Real Audio file. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious media file.The specific flaw exists in the parsing of audio codec information encapsulated in a Real Audio media file. By specifying a large number of subbands an allocated heap chunk can be overflown. Successful exploitation can result in system compromise under the credentials of the currently logged in user. Real Networks released an advisory regarding 27 security vulnerabilities in RealPlayer. Real Networks RealPlayer is prone to a heap overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. This issue affects Windows RealPlayer SP 1.1.5 and prior, Mac RealPlayer 12.0.0.1444 and prior, Linux RealPlayer 11.0.2.1744 and prior. NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial: http://secunia.com/products/corporate/vim/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38550
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/38550/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
RELEASE DATE: 2010-12-12
DISCUSS ADVISORY: http://secunia.com/advisories/38550/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/38550/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system.
1) An error exists when parsing RealAudio content encoded using the "cook" codec. This can be exploited to trigger the use of uninitialised memory and potentially cause a memory corruption via e.g. a specially crafted RealMedia file.
2) An error in the handling of errors encountered while decoding "cook"-encoded audio content can be exploited to trigger the use of uninitialised memory and potentially free an arbitrary address.
3) An error in the parsing of AAC audio content can be exploited to corrupt memory via specially crafted spectral data.
4) An array indexing error when parsing Media Properties Header (MDPR) in a RealMedia file can be exploited to corrupt memory.
5) An input validation error when parsing a RealMedia file can be exploited to cause a buffer overflow via a specially crafted multi-rate audio stream.
6) An error in the processing of the "StreamTitle" tag in a SHOUTcast stream using the ICY protocol can be exploited to cause an allocation failure for heap memory, which can result in the usage of freed pointers.
7) An integer overflow error when parsing a MLLT atom in an .AAC file can be exploited to cause a buffer overflow.
8) An input validation error in the "pnen3260.dll" module in the parsing of TIT2 atoms within AAC files can be exploited to corrupt memory.
9) An integer overflow in the parsing of GIF87a files over the streaming protocol RTSP can be exploited to cause a buffer overflow via a large "Screen Width" size in the "Screen Descriptor" header.
11) An input validation error in drv2.dll when decompressing RV20 video streams can be exploited to corrupt heap memory.
12) An unspecified error related to "SIPR" parsing can be exploited to corrupt heap memory.
13) An unspecified error related to "SOUND" processing can be exploited to corrupt heap memory.
14) An unspecified error related to "AAC" processing can be exploited to corrupt heap memory.
15) An unspecified error related to "RealMedia" processing can be exploited to corrupt heap memory.
16) An unspecified error related to "RA5" processing can be exploited to corrupt heap memory.
17) An integer overflow in "drv1.dll" when parsing SIPR stream metadata can be exploited to cause a heap-based buffer overflow, e.g. via the RealPlayer ActiveX control.
18) An input validation error in the processing of RealMedia files can be exploited to corrupt heap memory.
19) An input validation error in the RealAudio codec when processing RealMedia files can be exploited to corrupt heap memory.
20) An error in the "HandleAction" method in the RealPlayer ActiveX control allows users to download and execute scripts in the "Local Zone".
21) Input sanitisation errors in the "Custsupport.html", "Main.html", and "Upsell.htm" components can be exploited to inject arbitrary code into the RealOneActiveXObject process and load unsafe controls.
22) A boundary error in the parsing of cook-specific data used for initialization can be exploited to cause a heap-based buffer overflow.
23) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to cause a heap-based buffer overflow via an invalid size for an embedded MDPR chunk.
24) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to corrupt heap memory via an invalid number streams within the chunk.
25) An input validation error when parsing the RMX file format can be exploited to cause a heap-based buffer overflow.
26) An error when decoding data for particular mime types within a RealMedia file can be exploited to cause a heap-based buffer overflow.
27) An error in the parsing of server headers can be exploited to cause a heap-based buffer overflow via an image tag pointing to a malicious server, which causes the player to fetch a remote file.
28) An error in the implementation of the Advanced Audio Coding compression when decoding a conditional component of a data block within an AAC frame can be exploited to corrupt memory.
SOLUTION: Upgrade to RealPlayer 14.0.0 or later.
PROVIDED AND/OR DISCOVERED BY: 1, 2) Alin Rad Pop, Secunia Research. 3) Carsten Eiram, Secunia Research. 4) Anonymous and Hossein Lotfi, reported via ZDI. 5 - 11, 20, 21) Anonymous, reported via ZDI. 12 - 14) The vendor credits Nicolas Joly, Vupen 15) The vendor credits Chaouki Bekrar, Vupen 17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs 18, 19) Omair, reported via iDefense. 22, 28) Damian Put, reported via ZDI. 23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team lollersk8erz. 25) Sebastian Apelt, reported via ZDI. 26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. 27) AbdulAziz Hariri, reported via ZDI.
ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2010-9/ http://secunia.com/secunia_research/2010-14/ http://secunia.com/secunia_research/2010-15/
RealNetworks: http://service.real.com/realplayer/security/12102010_player/en/ http://realnetworksblog.com/?p=2216
ZDI: http://www.zerodayinitiative.com/advisories/ZDI-10-268/ http://www.zerodayinitiative.com/advisories/ZDI-10-266/ http://www.zerodayinitiative.com/advisories/ZDI-10-270/ http://www.zerodayinitiative.com/advisories/ZDI-10-273/ http://www.zerodayinitiative.com/advisories/ZDI-10-269/ http://www.zerodayinitiative.com/advisories/ZDI-10-271/ http://www.zerodayinitiative.com/advisories/ZDI-10-272/ http://www.zerodayinitiative.com/advisories/ZDI-10-274/ http://www.zerodayinitiative.com/advisories/ZDI-10-275/ http://www.zerodayinitiative.com/advisories/ZDI-10-276/ http://www.zerodayinitiative.com/advisories/ZDI-10-277/ http://www.zerodayinitiative.com/advisories/ZDI-10-278/ http://www.zerodayinitiative.com/advisories/ZDI-10-279/ http://www.zerodayinitiative.com/advisories/ZDI-10-281/ http://www.zerodayinitiative.com/advisories/ZDI-10-280/ http://www.zerodayinitiative.com/advisories/ZDI-10-282/ http://www.zerodayinitiative.com/advisories/ZDI-10-267/
TippingPoint DVLabs: http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html
iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. ZDI-10-272: RealNetworks RealPlayer Cook Audio Codec Parsing Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-10-272
December 10, 2010
-- CVE ID: CVE-2010-4377
-- CVSS: 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)
-- Affected Vendors: RealNetworks
-- Affected Products: RealNetworks RealPlayer
-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 8454.
-- Vendor Response: RealNetworks has issued an update to correct this vulnerability. More details can be found at:
http://service.real.com/realplayer/security/12102010_player/en/
-- Disclosure Timeline: 2009-06-25 - Vulnerability reported to vendor 2010-12-10 - Coordinated public release of advisory
-- Credit: This vulnerability was discovered by: * Anonymous
-- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201012-0254",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer sp",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "1.1.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.1.4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.0.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.0.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.1.3"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.1.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0.2.1744 (linux)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "12.0.0.1444 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0 to 1.0.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.2 to 1.1.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.1.2 to 1.1.4"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.1.5"
},
{
"model": "realplayer",
"scope": null,
"trust": 0.7,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "116.0.14.550"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer for mac",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "12.0.0.1548"
},
{
"model": "realplayer for linux",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0.2.2315"
},
{
"model": "realplayer",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "14.0.1"
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.3"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.4"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-272"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45412"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002588"
},
{
"db": "NVD",
"id": "CVE-2010-4377"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-158"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:12.0.0.1444:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4377"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Anonymous",
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-272"
},
{
"db": "BID",
"id": "45412"
}
],
"trust": 1.0
},
"cve": "CVE-2010-4377",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-4377",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2010-4377",
"impactScore": 8.5,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-46982",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-4377",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2010-4377",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201012-158",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-46982",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-272"
},
{
"db": "VULHUB",
"id": "VHN-46982"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002588"
},
{
"db": "NVD",
"id": "CVE-2010-4377"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-158"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, Mac RealPlayer 11.0 through 12.0.0.1444, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code by specifying many subbands in cook audio codec information in a Real Audio file. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious media file.The specific flaw exists in the parsing of audio codec information encapsulated in a Real Audio media file. By specifying a large number of subbands an allocated heap chunk can be overflown. Successful exploitation can result in system compromise under the credentials of the currently logged in user. \nReal Networks released an advisory regarding 27 security vulnerabilities in RealPlayer. Real Networks RealPlayer is prone to a heap overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. \nThis issue affects Windows RealPlayer SP 1.1.5 and prior, Mac RealPlayer 12.0.0.1444 and prior, Linux RealPlayer 11.0.2.1744 and prior. \nNOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nRequest a free trial: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38550\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/38550/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nRELEASE DATE:\n2010-12-12\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/38550/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/38550/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in RealPlayer, which can\nbe exploited by malicious people to compromise a user\u0027s system. \n\n1) An error exists when parsing RealAudio content encoded using the\n\"cook\" codec. This can be exploited to trigger the use of\nuninitialised memory and potentially cause a memory corruption via\ne.g. a specially crafted RealMedia file. \n\n2) An error in the handling of errors encountered while decoding\n\"cook\"-encoded audio content can be exploited to trigger the use of\nuninitialised memory and potentially free an arbitrary address. \n\n3) An error in the parsing of AAC audio content can be exploited to\ncorrupt memory via specially crafted spectral data. \n\n4) An array indexing error when parsing Media Properties Header\n(MDPR) in a RealMedia file can be exploited to corrupt memory. \n\n5) An input validation error when parsing a RealMedia file can be\nexploited to cause a buffer overflow via a specially crafted\nmulti-rate audio stream. \n\n6) An error in the processing of the \"StreamTitle\" tag in a SHOUTcast\nstream using the ICY protocol can be exploited to cause an allocation\nfailure for heap memory, which can result in the usage of freed\npointers. \n\n7) An integer overflow error when parsing a MLLT atom in an .AAC file\ncan be exploited to cause a buffer overflow. \n\n8) An input validation error in the \"pnen3260.dll\" module in the\nparsing of TIT2 atoms within AAC files can be exploited to corrupt\nmemory. \n\n9) An integer overflow in the parsing of GIF87a files over the\nstreaming protocol RTSP can be exploited to cause a buffer overflow\nvia a large \"Screen Width\" size in the \"Screen Descriptor\" header. \n\n11) An input validation error in drv2.dll when decompressing RV20\nvideo streams can be exploited to corrupt heap memory. \n\n12) An unspecified error related to \"SIPR\" parsing can be exploited\nto corrupt heap memory. \n\n13) An unspecified error related to \"SOUND\" processing can be\nexploited to corrupt heap memory. \n\n14) An unspecified error related to \"AAC\" processing can be exploited\nto corrupt heap memory. \n\n15) An unspecified error related to \"RealMedia\" processing can be\nexploited to corrupt heap memory. \n\n16) An unspecified error related to \"RA5\" processing can be exploited\nto corrupt heap memory. \n\n17) An integer overflow in \"drv1.dll\" when parsing SIPR stream\nmetadata can be exploited to cause a heap-based buffer overflow, e.g. \nvia the RealPlayer ActiveX control. \n\n18) An input validation error in the processing of RealMedia files\ncan be exploited to corrupt heap memory. \n\n19) An input validation error in the RealAudio codec when processing\nRealMedia files can be exploited to corrupt heap memory. \n\n20) An error in the \"HandleAction\" method in the RealPlayer ActiveX\ncontrol allows users to download and execute scripts in the \"Local\nZone\". \n\n21) Input sanitisation errors in the \"Custsupport.html\", \"Main.html\",\nand \"Upsell.htm\" components can be exploited to inject arbitrary code\ninto the RealOneActiveXObject process and load unsafe controls. \n\n22) A boundary error in the parsing of cook-specific data used for\ninitialization can be exploited to cause a heap-based buffer\noverflow. \n\n23) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to cause a heap-based\nbuffer overflow via an invalid size for an embedded MDPR chunk. \n\n24) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to corrupt heap memory\nvia an invalid number streams within the chunk. \n\n25) An input validation error when parsing the RMX file format can be\nexploited to cause a heap-based buffer overflow. \n\n26) An error when decoding data for particular mime types within a\nRealMedia file can be exploited to cause a heap-based buffer\noverflow. \n\n27) An error in the parsing of server headers can be exploited to\ncause a heap-based buffer overflow via an image tag pointing to a\nmalicious server, which causes the player to fetch a remote file. \n\n28) An error in the implementation of the Advanced Audio Coding\ncompression when decoding a conditional component of a data block\nwithin an AAC frame can be exploited to corrupt memory. \n\nSOLUTION:\nUpgrade to RealPlayer 14.0.0 or later. \n\nPROVIDED AND/OR DISCOVERED BY:\n1, 2) Alin Rad Pop, Secunia Research. \n3) Carsten Eiram, Secunia Research. \n4) Anonymous and Hossein Lotfi, reported via ZDI. \n5 - 11, 20, 21) Anonymous, reported via ZDI. \n12 - 14) The vendor credits Nicolas Joly, Vupen\n15) The vendor credits Chaouki Bekrar, Vupen\n17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs\n18, 19) Omair, reported via iDefense. \n22, 28) Damian Put, reported via ZDI. \n23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team\nlollersk8erz. \n25) Sebastian Apelt, reported via ZDI. \n26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. \n27) AbdulAziz Hariri, reported via ZDI. \n\nORIGINAL ADVISORY:\nSecunia Research:\nhttp://secunia.com/secunia_research/2010-9/\nhttp://secunia.com/secunia_research/2010-14/\nhttp://secunia.com/secunia_research/2010-15/\n\nRealNetworks:\nhttp://service.real.com/realplayer/security/12102010_player/en/\nhttp://realnetworksblog.com/?p=2216\n\nZDI:\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-268/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-266/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-270/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-273/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-269/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-271/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-272/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-274/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-275/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-276/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-277/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-278/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-279/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-281/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-280/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-282/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-267/\n\nTippingPoint DVLabs:\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html\n\niDefense Labs:\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. ZDI-10-272: RealNetworks RealPlayer Cook Audio Codec Parsing Remote Code Execution Vulnerability\n\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-272\n\nDecember 10, 2010\n\n-- CVE ID:\nCVE-2010-4377\n\n-- CVSS:\n9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)\n\n-- Affected Vendors:\nRealNetworks\n\n-- Affected Products:\nRealNetworks RealPlayer\n\n-- TippingPoint(TM) IPS Customer Protection:\nTippingPoint IPS customers have been protected against this\nvulnerability by Digital Vaccine protection filter ID 8454. \n\n-- Vendor Response:\nRealNetworks has issued an update to correct this vulnerability. More\ndetails can be found at:\n\nhttp://service.real.com/realplayer/security/12102010_player/en/\n\n-- Disclosure Timeline:\n2009-06-25 - Vulnerability reported to vendor\n2010-12-10 - Coordinated public release of advisory\n\n-- Credit:\nThis vulnerability was discovered by:\n * Anonymous\n\n-- About the Zero Day Initiative (ZDI):\nEstablished by TippingPoint, The Zero Day Initiative (ZDI) represents\na best-of-breed model for rewarding security researchers for responsibly\ndisclosing discovered vulnerabilities. \n\nResearchers interested in getting paid for their security research\nthrough the ZDI can find more information and sign-up at:\n\n http://www.zerodayinitiative.com\n\nThe ZDI is unique in how the acquired vulnerability information is\nused. TippingPoint does not re-sell the vulnerability details or any\nexploit code. Instead, upon notifying the affected product vendor,\nTippingPoint provides its customers with zero day protection through\nits intrusion prevention technology. Explicit details regarding the\nspecifics of the vulnerability are not exposed to any parties until\nan official vendor patch is publicly available. Furthermore, with the\naltruistic aim of helping to secure a broader user base, TippingPoint\nprovides this vulnerability information confidentially to security\nvendors (including competitors) who have a vulnerability protection or\nmitigation product. \n\nOur vulnerability disclosure policy is available online at:\n\n http://www.zerodayinitiative.com/advisories/disclosure_policy/\n\nFollow the ZDI on Twitter:\n\n http://twitter.com/thezdi\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4377"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002588"
},
{
"db": "ZDI",
"id": "ZDI-10-272"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45412"
},
{
"db": "VULHUB",
"id": "VHN-46982"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96594"
},
{
"db": "PACKETSTORM",
"id": "96637"
}
],
"trust": 3.24
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-46982",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46982"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-4377",
"trust": 3.6
},
{
"db": "ZDI",
"id": "ZDI-10-272",
"trust": 3.2
},
{
"db": "SECUNIA",
"id": "38550",
"trust": 1.6
},
{
"db": "SECUNIA",
"id": "42565",
"trust": 1.5
},
{
"db": "SECTRACK",
"id": "1024861",
"trust": 1.1
},
{
"db": "VUPEN",
"id": "ADV-2010-3190",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002588",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-506",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201012-158",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "42512",
"trust": 0.7
},
{
"db": "BID",
"id": "45412",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-273",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-266",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-280",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-267",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-269",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-277",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-268",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-274",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-271",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-276",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-278",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-279",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-282",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-270",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-275",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-281",
"trust": 0.4
},
{
"db": "BID",
"id": "45327",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "96594",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-46982",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96640",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96637",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-272"
},
{
"db": "VULHUB",
"id": "VHN-46982"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45412"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002588"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96594"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4377"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-158"
}
]
},
"id": "VAR-201012-0254",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-46982"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:10:58.885000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/ja"
},
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/en"
},
{
"title": "RealNetworks has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"title": "RealPlayerSP",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35884"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35883"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35882"
},
{
"title": "RealPlayer",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35881"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-272"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002588"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-158"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46982"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002588"
},
{
"db": "NVD",
"id": "CVE-2010-4377"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"trust": 2.4,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/38550"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/42565"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id?1024861"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4377"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-4377"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2010/3190"
},
{
"trust": 0.6,
"url": "http://realnetworksblog.com/?p=2192"
},
{
"trust": 0.6,
"url": "http://dvlabs.tippingpoint.com/blog/2010/12/09/realnetworks-patches-27-vulnerabilities"
},
{
"trust": 0.6,
"url": "http://www.real.com/"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/42512"
},
{
"trust": 0.4,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883"
},
{
"trust": 0.4,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884"
},
{
"trust": 0.3,
"url": "/archive/1/515235"
},
{
"trust": 0.3,
"url": "/archive/1/515236"
},
{
"trust": 0.3,
"url": "/archive/1/515238"
},
{
"trust": 0.3,
"url": "/archive/1/515237"
},
{
"trust": 0.3,
"url": "/archive/1/515234"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/advisory/tpti-10-18"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/advisory/tpti-10-19"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.3,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.3,
"url": "http://realnetworksblog.com/?p=2216"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-14/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-15/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-9/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/#comments"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42512/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42512"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42512/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/disclosure_policy/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-4377"
},
{
"trust": 0.1,
"url": "http://twitter.com/thezdi"
},
{
"trust": 0.1,
"url": "http://www.tippingpoint.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42565"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-272"
},
{
"db": "VULHUB",
"id": "VHN-46982"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45412"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002588"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96594"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4377"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-158"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-10-272"
},
{
"db": "VULHUB",
"id": "VHN-46982"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45412"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002588"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96594"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4377"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-158"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-10T00:00:00",
"db": "ZDI",
"id": "ZDI-10-272"
},
{
"date": "2010-12-14T00:00:00",
"db": "VULHUB",
"id": "VHN-46982"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45327"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45412"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002588"
},
{
"date": "2010-12-13T04:13:47",
"db": "PACKETSTORM",
"id": "96636"
},
{
"date": "2010-12-13T04:13:58",
"db": "PACKETSTORM",
"id": "96640"
},
{
"date": "2010-12-11T15:18:33",
"db": "PACKETSTORM",
"id": "96594"
},
{
"date": "2010-12-13T04:13:50",
"db": "PACKETSTORM",
"id": "96637"
},
{
"date": "2010-12-14T16:00:04.383000",
"db": "NVD",
"id": "CVE-2010-4377"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-158"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-10T00:00:00",
"db": "ZDI",
"id": "ZDI-10-272"
},
{
"date": "2011-01-19T00:00:00",
"db": "VULHUB",
"id": "VHN-46982"
},
{
"date": "2010-12-16T22:14:00",
"db": "BID",
"id": "45327"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45412"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002588"
},
{
"date": "2011-01-19T07:02:02.457000",
"db": "NVD",
"id": "CVE-2010-4377"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-158"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "96594"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-158"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer of Cook Audio Codec Heap-based buffer overflow vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002588"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-158"
}
],
"trust": 0.6
}
}
VAR-201012-0319
Vulnerability from variot - Updated: 2023-12-18 12:10Use-after-free vulnerability in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.0.1, Mac RealPlayer 11.0 through 11.1, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted StreamTitle tag in an ICY SHOUTcast stream, related to the SMIL file format. User interaction is required to exploit this vulnerability in that the target must open a malicious SHOUTcast Stream.The specific flaw exists in the processing of the StreamTitle tag in a SHOUTcast stream using the ICY protocol. A specially crafted string supplied as the property for the title can result in a failed allocation of heap memory. This then causes the freeing of critical pointers that are subsequently used after freeing. Successful exploitation of this vulnerability can lead to system compromise under the credentials of the currently logged in user. Real Networks released an advisory regarding 27 security vulnerabilities in RealPlayer. Real Networks RealPlayer is prone to heap corruption vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. This issue affects Windows RealPlayer SP 1.0.1 and prior, Mac RealPlayer 11.1.0.1116 and prior, Linux RealPlayer 11.0.2.1744 and prior. NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial: http://secunia.com/products/corporate/vim/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38550
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/38550/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
RELEASE DATE: 2010-12-12
DISCUSS ADVISORY: http://secunia.com/advisories/38550/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/38550/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system.
1) An error exists when parsing RealAudio content encoded using the "cook" codec. This can be exploited to trigger the use of uninitialised memory and potentially cause a memory corruption via e.g. a specially crafted RealMedia file.
2) An error in the handling of errors encountered while decoding "cook"-encoded audio content can be exploited to trigger the use of uninitialised memory and potentially free an arbitrary address.
3) An error in the parsing of AAC audio content can be exploited to corrupt memory via specially crafted spectral data.
4) An array indexing error when parsing Media Properties Header (MDPR) in a RealMedia file can be exploited to corrupt memory.
5) An input validation error when parsing a RealMedia file can be exploited to cause a buffer overflow via a specially crafted multi-rate audio stream.
7) An integer overflow error when parsing a MLLT atom in an .AAC file can be exploited to cause a buffer overflow.
8) An input validation error in the "pnen3260.dll" module in the parsing of TIT2 atoms within AAC files can be exploited to corrupt memory.
9) An integer overflow in the parsing of GIF87a files over the streaming protocol RTSP can be exploited to cause a buffer overflow via a large "Screen Width" size in the "Screen Descriptor" header.
10) An error in the parsing of audio codec information in a Real Audio media file can be exploited to to cause a heap-based buffer overflow via a large number of subbands.
11) An input validation error in drv2.dll when decompressing RV20 video streams can be exploited to corrupt heap memory.
12) An unspecified error related to "SIPR" parsing can be exploited to corrupt heap memory.
13) An unspecified error related to "SOUND" processing can be exploited to corrupt heap memory.
14) An unspecified error related to "AAC" processing can be exploited to corrupt heap memory.
15) An unspecified error related to "RealMedia" processing can be exploited to corrupt heap memory.
16) An unspecified error related to "RA5" processing can be exploited to corrupt heap memory.
17) An integer overflow in "drv1.dll" when parsing SIPR stream metadata can be exploited to cause a heap-based buffer overflow, e.g. via the RealPlayer ActiveX control.
18) An input validation error in the processing of RealMedia files can be exploited to corrupt heap memory.
19) An input validation error in the RealAudio codec when processing RealMedia files can be exploited to corrupt heap memory.
20) An error in the "HandleAction" method in the RealPlayer ActiveX control allows users to download and execute scripts in the "Local Zone".
21) Input sanitisation errors in the "Custsupport.html", "Main.html", and "Upsell.htm" components can be exploited to inject arbitrary code into the RealOneActiveXObject process and load unsafe controls.
22) A boundary error in the parsing of cook-specific data used for initialization can be exploited to cause a heap-based buffer overflow.
23) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to cause a heap-based buffer overflow via an invalid size for an embedded MDPR chunk.
24) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to corrupt heap memory via an invalid number streams within the chunk.
25) An input validation error when parsing the RMX file format can be exploited to cause a heap-based buffer overflow.
26) An error when decoding data for particular mime types within a RealMedia file can be exploited to cause a heap-based buffer overflow.
27) An error in the parsing of server headers can be exploited to cause a heap-based buffer overflow via an image tag pointing to a malicious server, which causes the player to fetch a remote file.
28) An error in the implementation of the Advanced Audio Coding compression when decoding a conditional component of a data block within an AAC frame can be exploited to corrupt memory.
SOLUTION: Upgrade to RealPlayer 14.0.0 or later.
PROVIDED AND/OR DISCOVERED BY: 1, 2) Alin Rad Pop, Secunia Research. 3) Carsten Eiram, Secunia Research. 4) Anonymous and Hossein Lotfi, reported via ZDI. 5 - 11, 20, 21) Anonymous, reported via ZDI. 12 - 14) The vendor credits Nicolas Joly, Vupen 15) The vendor credits Chaouki Bekrar, Vupen 17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs 18, 19) Omair, reported via iDefense. 22, 28) Damian Put, reported via ZDI. 23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team lollersk8erz. 25) Sebastian Apelt, reported via ZDI. 26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. 27) AbdulAziz Hariri, reported via ZDI.
ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2010-9/ http://secunia.com/secunia_research/2010-14/ http://secunia.com/secunia_research/2010-15/
RealNetworks: http://service.real.com/realplayer/security/12102010_player/en/ http://realnetworksblog.com/?p=2216
ZDI: http://www.zerodayinitiative.com/advisories/ZDI-10-268/ http://www.zerodayinitiative.com/advisories/ZDI-10-266/ http://www.zerodayinitiative.com/advisories/ZDI-10-270/ http://www.zerodayinitiative.com/advisories/ZDI-10-273/ http://www.zerodayinitiative.com/advisories/ZDI-10-269/ http://www.zerodayinitiative.com/advisories/ZDI-10-271/ http://www.zerodayinitiative.com/advisories/ZDI-10-272/ http://www.zerodayinitiative.com/advisories/ZDI-10-274/ http://www.zerodayinitiative.com/advisories/ZDI-10-275/ http://www.zerodayinitiative.com/advisories/ZDI-10-276/ http://www.zerodayinitiative.com/advisories/ZDI-10-277/ http://www.zerodayinitiative.com/advisories/ZDI-10-278/ http://www.zerodayinitiative.com/advisories/ZDI-10-279/ http://www.zerodayinitiative.com/advisories/ZDI-10-281/ http://www.zerodayinitiative.com/advisories/ZDI-10-280/ http://www.zerodayinitiative.com/advisories/ZDI-10-282/ http://www.zerodayinitiative.com/advisories/ZDI-10-267/
TippingPoint DVLabs: http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html
iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. ZDI-10-270: RealNetworks RealPlayer ICY Protocol StreamTitle Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-10-270
December 10, 2010
-- CVE ID: CVE-2010-2997
-- CVSS: 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)
-- Affected Vendors: RealNetworks
-- Affected Products: RealNetworks RealPlayer
-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 8344.
-- Vendor Response: RealNetworks has issued an update to correct this vulnerability. More details can be found at:
http://service.real.com/realplayer/security/12102010_player/en/
-- Disclosure Timeline: 2009-06-25 - Vulnerability reported to vendor 2010-12-10 - Coordinated public release of advisory
-- Credit: This vulnerability was discovered by: * Anonymous
-- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201012-0319",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer sp",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 2.2,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0.2.1744 (linux)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0 to 1.0.1"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (es)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.0"
},
{
"model": "realplayer",
"scope": null,
"trust": 0.7,
"vendor": "realnetworks",
"version": null
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.6,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "116.0.14.550"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer for mac",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "12.0.0.1548"
},
{
"model": "realplayer for linux",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "11.0.2.2315"
},
{
"model": "realplayer",
"scope": "ne",
"trust": 0.6,
"vendor": "realnetworks",
"version": "14.0.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.3"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.3"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.4"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-270"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45407"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002584"
},
{
"db": "NVD",
"id": "CVE-2010-2997"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-164"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-2997"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Anonymous",
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-270"
},
{
"db": "BID",
"id": "45407"
}
],
"trust": 1.0
},
"cve": "CVE-2010-2997",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-2997",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2010-2997",
"impactScore": 8.5,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-45602",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-2997",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2010-2997",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201012-164",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-45602",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-270"
},
{
"db": "VULHUB",
"id": "VHN-45602"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002584"
},
{
"db": "NVD",
"id": "CVE-2010-2997"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-164"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Use-after-free vulnerability in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.0.1, Mac RealPlayer 11.0 through 11.1, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted StreamTitle tag in an ICY SHOUTcast stream, related to the SMIL file format. User interaction is required to exploit this vulnerability in that the target must open a malicious SHOUTcast Stream.The specific flaw exists in the processing of the StreamTitle tag in a SHOUTcast stream using the ICY protocol. A specially crafted string supplied as the property for the title can result in a failed allocation of heap memory. This then causes the freeing of critical pointers that are subsequently used after freeing. Successful exploitation of this vulnerability can lead to system compromise under the credentials of the currently logged in user. \nReal Networks released an advisory regarding 27 security vulnerabilities in RealPlayer. Real Networks RealPlayer is prone to heap corruption vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. \nThis issue affects Windows RealPlayer SP 1.0.1 and prior, Mac RealPlayer 11.1.0.1116 and prior, Linux RealPlayer 11.0.2.1744 and prior. \nNOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nRequest a free trial: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38550\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/38550/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nRELEASE DATE:\n2010-12-12\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/38550/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/38550/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in RealPlayer, which can\nbe exploited by malicious people to compromise a user\u0027s system. \n\n1) An error exists when parsing RealAudio content encoded using the\n\"cook\" codec. This can be exploited to trigger the use of\nuninitialised memory and potentially cause a memory corruption via\ne.g. a specially crafted RealMedia file. \n\n2) An error in the handling of errors encountered while decoding\n\"cook\"-encoded audio content can be exploited to trigger the use of\nuninitialised memory and potentially free an arbitrary address. \n\n3) An error in the parsing of AAC audio content can be exploited to\ncorrupt memory via specially crafted spectral data. \n\n4) An array indexing error when parsing Media Properties Header\n(MDPR) in a RealMedia file can be exploited to corrupt memory. \n\n5) An input validation error when parsing a RealMedia file can be\nexploited to cause a buffer overflow via a specially crafted\nmulti-rate audio stream. \n\n7) An integer overflow error when parsing a MLLT atom in an .AAC file\ncan be exploited to cause a buffer overflow. \n\n8) An input validation error in the \"pnen3260.dll\" module in the\nparsing of TIT2 atoms within AAC files can be exploited to corrupt\nmemory. \n\n9) An integer overflow in the parsing of GIF87a files over the\nstreaming protocol RTSP can be exploited to cause a buffer overflow\nvia a large \"Screen Width\" size in the \"Screen Descriptor\" header. \n\n10) An error in the parsing of audio codec information in a Real\nAudio media file can be exploited to to cause a heap-based buffer\noverflow via a large number of subbands. \n\n11) An input validation error in drv2.dll when decompressing RV20\nvideo streams can be exploited to corrupt heap memory. \n\n12) An unspecified error related to \"SIPR\" parsing can be exploited\nto corrupt heap memory. \n\n13) An unspecified error related to \"SOUND\" processing can be\nexploited to corrupt heap memory. \n\n14) An unspecified error related to \"AAC\" processing can be exploited\nto corrupt heap memory. \n\n15) An unspecified error related to \"RealMedia\" processing can be\nexploited to corrupt heap memory. \n\n16) An unspecified error related to \"RA5\" processing can be exploited\nto corrupt heap memory. \n\n17) An integer overflow in \"drv1.dll\" when parsing SIPR stream\nmetadata can be exploited to cause a heap-based buffer overflow, e.g. \nvia the RealPlayer ActiveX control. \n\n18) An input validation error in the processing of RealMedia files\ncan be exploited to corrupt heap memory. \n\n19) An input validation error in the RealAudio codec when processing\nRealMedia files can be exploited to corrupt heap memory. \n\n20) An error in the \"HandleAction\" method in the RealPlayer ActiveX\ncontrol allows users to download and execute scripts in the \"Local\nZone\". \n\n21) Input sanitisation errors in the \"Custsupport.html\", \"Main.html\",\nand \"Upsell.htm\" components can be exploited to inject arbitrary code\ninto the RealOneActiveXObject process and load unsafe controls. \n\n22) A boundary error in the parsing of cook-specific data used for\ninitialization can be exploited to cause a heap-based buffer\noverflow. \n\n23) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to cause a heap-based\nbuffer overflow via an invalid size for an embedded MDPR chunk. \n\n24) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to corrupt heap memory\nvia an invalid number streams within the chunk. \n\n25) An input validation error when parsing the RMX file format can be\nexploited to cause a heap-based buffer overflow. \n\n26) An error when decoding data for particular mime types within a\nRealMedia file can be exploited to cause a heap-based buffer\noverflow. \n\n27) An error in the parsing of server headers can be exploited to\ncause a heap-based buffer overflow via an image tag pointing to a\nmalicious server, which causes the player to fetch a remote file. \n\n28) An error in the implementation of the Advanced Audio Coding\ncompression when decoding a conditional component of a data block\nwithin an AAC frame can be exploited to corrupt memory. \n\nSOLUTION:\nUpgrade to RealPlayer 14.0.0 or later. \n\nPROVIDED AND/OR DISCOVERED BY:\n1, 2) Alin Rad Pop, Secunia Research. \n3) Carsten Eiram, Secunia Research. \n4) Anonymous and Hossein Lotfi, reported via ZDI. \n5 - 11, 20, 21) Anonymous, reported via ZDI. \n12 - 14) The vendor credits Nicolas Joly, Vupen\n15) The vendor credits Chaouki Bekrar, Vupen\n17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs\n18, 19) Omair, reported via iDefense. \n22, 28) Damian Put, reported via ZDI. \n23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team\nlollersk8erz. \n25) Sebastian Apelt, reported via ZDI. \n26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. \n27) AbdulAziz Hariri, reported via ZDI. \n\nORIGINAL ADVISORY:\nSecunia Research:\nhttp://secunia.com/secunia_research/2010-9/\nhttp://secunia.com/secunia_research/2010-14/\nhttp://secunia.com/secunia_research/2010-15/\n\nRealNetworks:\nhttp://service.real.com/realplayer/security/12102010_player/en/\nhttp://realnetworksblog.com/?p=2216\n\nZDI:\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-268/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-266/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-270/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-273/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-269/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-271/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-272/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-274/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-275/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-276/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-277/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-278/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-279/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-281/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-280/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-282/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-267/\n\nTippingPoint DVLabs:\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html\n\niDefense Labs:\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. ZDI-10-270: RealNetworks RealPlayer ICY Protocol StreamTitle Remote Code Execution Vulnerability\n\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-270\n\nDecember 10, 2010\n\n-- CVE ID:\nCVE-2010-2997\n\n-- CVSS:\n9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)\n\n-- Affected Vendors:\nRealNetworks\n\n-- Affected Products:\nRealNetworks RealPlayer\n\n-- TippingPoint(TM) IPS Customer Protection:\nTippingPoint IPS customers have been protected against this\nvulnerability by Digital Vaccine protection filter ID 8344. \n\n-- Vendor Response:\nRealNetworks has issued an update to correct this vulnerability. More\ndetails can be found at:\n\nhttp://service.real.com/realplayer/security/12102010_player/en/\n\n-- Disclosure Timeline:\n2009-06-25 - Vulnerability reported to vendor\n2010-12-10 - Coordinated public release of advisory\n\n-- Credit:\nThis vulnerability was discovered by:\n * Anonymous\n\n-- About the Zero Day Initiative (ZDI):\nEstablished by TippingPoint, The Zero Day Initiative (ZDI) represents\na best-of-breed model for rewarding security researchers for responsibly\ndisclosing discovered vulnerabilities. \n\nResearchers interested in getting paid for their security research\nthrough the ZDI can find more information and sign-up at:\n\n http://www.zerodayinitiative.com\n\nThe ZDI is unique in how the acquired vulnerability information is\nused. Instead, upon notifying the affected product vendor,\nTippingPoint provides its customers with zero day protection through\nits intrusion prevention technology. Explicit details regarding the\nspecifics of the vulnerability are not exposed to any parties until\nan official vendor patch is publicly available. Furthermore, with the\naltruistic aim of helping to secure a broader user base, TippingPoint\nprovides this vulnerability information confidentially to security\nvendors (including competitors) who have a vulnerability protection or\nmitigation product. \n\nOur vulnerability disclosure policy is available online at:\n\n http://www.zerodayinitiative.com/advisories/disclosure_policy/\n\nFollow the ZDI on Twitter:\n\n http://twitter.com/thezdi\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-2997"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002584"
},
{
"db": "ZDI",
"id": "ZDI-10-270"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45407"
},
{
"db": "VULHUB",
"id": "VHN-45602"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96592"
},
{
"db": "PACKETSTORM",
"id": "96637"
}
],
"trust": 3.15
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-45602",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-45602"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-2997",
"trust": 3.6
},
{
"db": "ZDI",
"id": "ZDI-10-270",
"trust": 3.2
},
{
"db": "SECUNIA",
"id": "38550",
"trust": 1.6
},
{
"db": "SECUNIA",
"id": "42565",
"trust": 1.5
},
{
"db": "SECTRACK",
"id": "1024861",
"trust": 1.1
},
{
"db": "VUPEN",
"id": "ADV-2010-3190",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002584",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-509",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201012-164",
"trust": 0.7
},
{
"db": "BID",
"id": "45407",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-273",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-266",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-280",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-267",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-269",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-277",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-272",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-268",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-274",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-271",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-276",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-278",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-279",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-282",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-275",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-281",
"trust": 0.4
},
{
"db": "BID",
"id": "45327",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "96592",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-45602",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96637",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-270"
},
{
"db": "VULHUB",
"id": "VHN-45602"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45407"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002584"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96592"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-2997"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-164"
}
]
},
"id": "VAR-201012-0319",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-45602"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:10:58.248000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/ja"
},
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/en"
},
{
"title": "RHSA-2010:0981",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2010-0981.html"
},
{
"title": "RealNetworks has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"title": "RealPlayerSP",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35884"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35883"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35882"
},
{
"title": "RealPlayer",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35881"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-270"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002584"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-164"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-399",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-45602"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002584"
},
{
"db": "NVD",
"id": "CVE-2010-2997"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"trust": 2.4,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/38550"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/42565"
},
{
"trust": 1.1,
"url": "http://www.redhat.com/support/errata/rhsa-2010-0981.html"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id?1024861"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2997"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-2997"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2010/3190"
},
{
"trust": 0.6,
"url": "http://realnetworksblog.com/?p=2192"
},
{
"trust": 0.6,
"url": "http://dvlabs.tippingpoint.com/blog/2010/12/09/realnetworks-patches-27-vulnerabilities"
},
{
"trust": 0.6,
"url": "http://www.real.com/"
},
{
"trust": 0.4,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883"
},
{
"trust": 0.4,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884"
},
{
"trust": 0.3,
"url": "/archive/1/515235"
},
{
"trust": 0.3,
"url": "/archive/1/515236"
},
{
"trust": 0.3,
"url": "/archive/1/515238"
},
{
"trust": 0.3,
"url": "/archive/1/515237"
},
{
"trust": 0.3,
"url": "/archive/1/515234"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/advisory/tpti-10-18"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/advisory/tpti-10-19"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282"
},
{
"trust": 0.2,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.2,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.2,
"url": "http://realnetworksblog.com/?p=2216"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-14/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-15/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-9/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/#comments"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/disclosure_policy/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2997"
},
{
"trust": 0.1,
"url": "http://twitter.com/thezdi"
},
{
"trust": 0.1,
"url": "http://www.tippingpoint.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42565"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-270"
},
{
"db": "VULHUB",
"id": "VHN-45602"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45407"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002584"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96592"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-2997"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-164"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-10-270"
},
{
"db": "VULHUB",
"id": "VHN-45602"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45407"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002584"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96592"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-2997"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-164"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-10T00:00:00",
"db": "ZDI",
"id": "ZDI-10-270"
},
{
"date": "2010-12-14T00:00:00",
"db": "VULHUB",
"id": "VHN-45602"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45327"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45407"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002584"
},
{
"date": "2010-12-13T04:13:47",
"db": "PACKETSTORM",
"id": "96636"
},
{
"date": "2010-12-11T15:17:42",
"db": "PACKETSTORM",
"id": "96592"
},
{
"date": "2010-12-13T04:13:50",
"db": "PACKETSTORM",
"id": "96637"
},
{
"date": "2010-12-14T16:00:02.913000",
"db": "NVD",
"id": "CVE-2010-2997"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-164"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-10T00:00:00",
"db": "ZDI",
"id": "ZDI-10-270"
},
{
"date": "2011-01-26T00:00:00",
"db": "VULHUB",
"id": "VHN-45602"
},
{
"date": "2010-12-16T22:14:00",
"db": "BID",
"id": "45327"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45407"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002584"
},
{
"date": "2011-01-26T06:50:03.337000",
"db": "NVD",
"id": "CVE-2010-2997"
},
{
"date": "2011-07-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-164"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "96592"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-164"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer Vulnerable to arbitrary code execution",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002584"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "resource management error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-164"
}
],
"trust": 0.6
}
}
VAR-201012-0253
Vulnerability from variot - Updated: 2023-12-18 12:10Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code via a large Screen Width value in the Screen Descriptor header of a GIF87a file in an RTSP stream. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious media file.The specific flaw exists in the parsing of GIF87a files over the streaming protocol RTSP. When specifying a large Screen Width size in the Screen Descriptor header a calculation on the destination heap chunks size is improperly checked for overflow. This leads to a smaller buffer being allocated and subsequently a heap overflow when processing the received data. Exploitation of this vulnerability can lead to system compromise under the credentials of the currently logged in user. Real Networks released an advisory regarding 27 security vulnerabilities in RealPlayer. Real Networks RealPlayer is prone to a heap overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. This issue affects Windows RealPlayer SP 1.1.1 and prior, Mac RealPlayer 11.1.0.1116 and prior, Linux RealPlayer 11.0.2.1744 and prior. NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial: http://secunia.com/products/corporate/vim/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38550
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/38550/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
RELEASE DATE: 2010-12-12
DISCUSS ADVISORY: http://secunia.com/advisories/38550/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/38550/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system.
1) An error exists when parsing RealAudio content encoded using the "cook" codec. This can be exploited to trigger the use of uninitialised memory and potentially cause a memory corruption via e.g. a specially crafted RealMedia file.
2) An error in the handling of errors encountered while decoding "cook"-encoded audio content can be exploited to trigger the use of uninitialised memory and potentially free an arbitrary address.
3) An error in the parsing of AAC audio content can be exploited to corrupt memory via specially crafted spectral data.
4) An array indexing error when parsing Media Properties Header (MDPR) in a RealMedia file can be exploited to corrupt memory.
5) An input validation error when parsing a RealMedia file can be exploited to cause a buffer overflow via a specially crafted multi-rate audio stream.
6) An error in the processing of the "StreamTitle" tag in a SHOUTcast stream using the ICY protocol can be exploited to cause an allocation failure for heap memory, which can result in the usage of freed pointers.
7) An integer overflow error when parsing a MLLT atom in an .AAC file can be exploited to cause a buffer overflow.
8) An input validation error in the "pnen3260.dll" module in the parsing of TIT2 atoms within AAC files can be exploited to corrupt memory.
10) An error in the parsing of audio codec information in a Real Audio media file can be exploited to to cause a heap-based buffer overflow via a large number of subbands.
11) An input validation error in drv2.dll when decompressing RV20 video streams can be exploited to corrupt heap memory.
12) An unspecified error related to "SIPR" parsing can be exploited to corrupt heap memory.
13) An unspecified error related to "SOUND" processing can be exploited to corrupt heap memory.
14) An unspecified error related to "AAC" processing can be exploited to corrupt heap memory.
15) An unspecified error related to "RealMedia" processing can be exploited to corrupt heap memory.
16) An unspecified error related to "RA5" processing can be exploited to corrupt heap memory.
17) An integer overflow in "drv1.dll" when parsing SIPR stream metadata can be exploited to cause a heap-based buffer overflow, e.g. via the RealPlayer ActiveX control.
18) An input validation error in the processing of RealMedia files can be exploited to corrupt heap memory.
19) An input validation error in the RealAudio codec when processing RealMedia files can be exploited to corrupt heap memory.
20) An error in the "HandleAction" method in the RealPlayer ActiveX control allows users to download and execute scripts in the "Local Zone".
21) Input sanitisation errors in the "Custsupport.html", "Main.html", and "Upsell.htm" components can be exploited to inject arbitrary code into the RealOneActiveXObject process and load unsafe controls.
23) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to cause a heap-based buffer overflow via an invalid size for an embedded MDPR chunk.
24) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to corrupt heap memory via an invalid number streams within the chunk.
25) An input validation error when parsing the RMX file format can be exploited to cause a heap-based buffer overflow.
26) An error when decoding data for particular mime types within a RealMedia file can be exploited to cause a heap-based buffer overflow.
27) An error in the parsing of server headers can be exploited to cause a heap-based buffer overflow via an image tag pointing to a malicious server, which causes the player to fetch a remote file.
28) An error in the implementation of the Advanced Audio Coding compression when decoding a conditional component of a data block within an AAC frame can be exploited to corrupt memory.
SOLUTION: Upgrade to RealPlayer 14.0.0 or later.
PROVIDED AND/OR DISCOVERED BY: 1, 2) Alin Rad Pop, Secunia Research. 3) Carsten Eiram, Secunia Research. 4) Anonymous and Hossein Lotfi, reported via ZDI. 5 - 11, 20, 21) Anonymous, reported via ZDI. 12 - 14) The vendor credits Nicolas Joly, Vupen 15) The vendor credits Chaouki Bekrar, Vupen 17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs 18, 19) Omair, reported via iDefense. 22, 28) Damian Put, reported via ZDI. 23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team lollersk8erz. 25) Sebastian Apelt, reported via ZDI. 26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. 27) AbdulAziz Hariri, reported via ZDI.
ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2010-9/ http://secunia.com/secunia_research/2010-14/ http://secunia.com/secunia_research/2010-15/
RealNetworks: http://service.real.com/realplayer/security/12102010_player/en/ http://realnetworksblog.com/?p=2216
ZDI: http://www.zerodayinitiative.com/advisories/ZDI-10-268/ http://www.zerodayinitiative.com/advisories/ZDI-10-266/ http://www.zerodayinitiative.com/advisories/ZDI-10-270/ http://www.zerodayinitiative.com/advisories/ZDI-10-273/ http://www.zerodayinitiative.com/advisories/ZDI-10-269/ http://www.zerodayinitiative.com/advisories/ZDI-10-271/ http://www.zerodayinitiative.com/advisories/ZDI-10-272/ http://www.zerodayinitiative.com/advisories/ZDI-10-274/ http://www.zerodayinitiative.com/advisories/ZDI-10-275/ http://www.zerodayinitiative.com/advisories/ZDI-10-276/ http://www.zerodayinitiative.com/advisories/ZDI-10-277/ http://www.zerodayinitiative.com/advisories/ZDI-10-278/ http://www.zerodayinitiative.com/advisories/ZDI-10-279/ http://www.zerodayinitiative.com/advisories/ZDI-10-281/ http://www.zerodayinitiative.com/advisories/ZDI-10-280/ http://www.zerodayinitiative.com/advisories/ZDI-10-282/ http://www.zerodayinitiative.com/advisories/ZDI-10-267/
TippingPoint DVLabs: http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html
iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. ZDI-10-271: RealNetworks RealPlayer RTSP GIF Parsing Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-10-271
December 10, 2010
-- CVE ID: CVE-2010-4376
-- CVSS: 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)
-- Affected Vendors: RealNetworks
-- Affected Products: RealNetworks RealPlayer
-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 8308.
-- Vendor Response: RealNetworks has issued an update to correct this vulnerability. More details can be found at:
http://service.real.com/realplayer/security/12102010_player/en/
-- Disclosure Timeline: 2009-06-25 - Vulnerability reported to vendor 2010-12-10 - Coordinated public release of advisory
-- Credit: This vulnerability was discovered by: * Anonymous
-- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201012-0253",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "1.1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0.2.1744 (linux)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0 to 1.0.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.2 to 1.1.1"
},
{
"model": "realplayer",
"scope": null,
"trust": 0.7,
"vendor": "realnetworks",
"version": null
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.3"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1.2"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.3"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.7"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.6"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.5"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.2"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer enterprise",
"scope": null,
"trust": 0.3,
"vendor": "realnetworks",
"version": null
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "116.0.14.550"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.331"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.503"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.481"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.412"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.396"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.352"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.325"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.0.305"
},
{
"model": "realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer for mac",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "12.0.0.1548"
},
{
"model": "realplayer for linux",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.0.2.2315"
},
{
"model": "realplayer enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.4"
},
{
"model": "realplayer",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "14.0.1"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0.5"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0.2"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0.1"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1.1"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1"
},
{
"model": "networks realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "12.0.0.1444"
},
{
"model": "networks realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.1"
},
{
"model": "networks realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.2.1744"
},
{
"model": "networks realplayer beta",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "116.0.14.550"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.331"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.503"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.481"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.412"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.396"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.352"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.325"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.305"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "10"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.1.3114"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.9"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.8"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.7"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.6"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.5"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.4"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.3"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.2"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.1"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "10"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.5"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.4"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.3"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.2"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.1"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.1"
},
{
"model": "networks realplayer beta",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11"
},
{
"model": "networks realplayer for mac",
"scope": "ne",
"trust": 0.3,
"vendor": "real",
"version": "12.0.0.1548"
},
{
"model": "networks realplayer for linux",
"scope": "ne",
"trust": 0.3,
"vendor": "real",
"version": "11.0.2.2315"
},
{
"model": "networks realplayer",
"scope": "ne",
"trust": 0.3,
"vendor": "real",
"version": "14.0.1"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-271"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45411"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002587"
},
{
"db": "NVD",
"id": "CVE-2010-4376"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-159"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4376"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Anonymous",
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-271"
},
{
"db": "BID",
"id": "45411"
}
],
"trust": 1.0
},
"cve": "CVE-2010-4376",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-4376",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2010-4376",
"impactScore": 8.5,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-46981",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-4376",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2010-4376",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201012-159",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-46981",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-271"
},
{
"db": "VULHUB",
"id": "VHN-46981"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002587"
},
{
"db": "NVD",
"id": "CVE-2010-4376"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-159"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code via a large Screen Width value in the Screen Descriptor header of a GIF87a file in an RTSP stream. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious media file.The specific flaw exists in the parsing of GIF87a files over the streaming protocol RTSP. When specifying a large Screen Width size in the Screen Descriptor header a calculation on the destination heap chunks size is improperly checked for overflow. This leads to a smaller buffer being allocated and subsequently a heap overflow when processing the received data. Exploitation of this vulnerability can lead to system compromise under the credentials of the currently logged in user. \nReal Networks released an advisory regarding 27 security vulnerabilities in RealPlayer. Real Networks RealPlayer is prone to a heap overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Failed exploit attempts will result in a denial-of-service condition. \nThis issue affects Windows RealPlayer SP 1.1.1 and prior, Mac RealPlayer 11.1.0.1116 and prior, Linux RealPlayer 11.0.2.1744 and prior. \nNOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nRequest a free trial: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38550\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/38550/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nRELEASE DATE:\n2010-12-12\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/38550/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/38550/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in RealPlayer, which can\nbe exploited by malicious people to compromise a user\u0027s system. \n\n1) An error exists when parsing RealAudio content encoded using the\n\"cook\" codec. This can be exploited to trigger the use of\nuninitialised memory and potentially cause a memory corruption via\ne.g. a specially crafted RealMedia file. \n\n2) An error in the handling of errors encountered while decoding\n\"cook\"-encoded audio content can be exploited to trigger the use of\nuninitialised memory and potentially free an arbitrary address. \n\n3) An error in the parsing of AAC audio content can be exploited to\ncorrupt memory via specially crafted spectral data. \n\n4) An array indexing error when parsing Media Properties Header\n(MDPR) in a RealMedia file can be exploited to corrupt memory. \n\n5) An input validation error when parsing a RealMedia file can be\nexploited to cause a buffer overflow via a specially crafted\nmulti-rate audio stream. \n\n6) An error in the processing of the \"StreamTitle\" tag in a SHOUTcast\nstream using the ICY protocol can be exploited to cause an allocation\nfailure for heap memory, which can result in the usage of freed\npointers. \n\n7) An integer overflow error when parsing a MLLT atom in an .AAC file\ncan be exploited to cause a buffer overflow. \n\n8) An input validation error in the \"pnen3260.dll\" module in the\nparsing of TIT2 atoms within AAC files can be exploited to corrupt\nmemory. \n\n10) An error in the parsing of audio codec information in a Real\nAudio media file can be exploited to to cause a heap-based buffer\noverflow via a large number of subbands. \n\n11) An input validation error in drv2.dll when decompressing RV20\nvideo streams can be exploited to corrupt heap memory. \n\n12) An unspecified error related to \"SIPR\" parsing can be exploited\nto corrupt heap memory. \n\n13) An unspecified error related to \"SOUND\" processing can be\nexploited to corrupt heap memory. \n\n14) An unspecified error related to \"AAC\" processing can be exploited\nto corrupt heap memory. \n\n15) An unspecified error related to \"RealMedia\" processing can be\nexploited to corrupt heap memory. \n\n16) An unspecified error related to \"RA5\" processing can be exploited\nto corrupt heap memory. \n\n17) An integer overflow in \"drv1.dll\" when parsing SIPR stream\nmetadata can be exploited to cause a heap-based buffer overflow, e.g. \nvia the RealPlayer ActiveX control. \n\n18) An input validation error in the processing of RealMedia files\ncan be exploited to corrupt heap memory. \n\n19) An input validation error in the RealAudio codec when processing\nRealMedia files can be exploited to corrupt heap memory. \n\n20) An error in the \"HandleAction\" method in the RealPlayer ActiveX\ncontrol allows users to download and execute scripts in the \"Local\nZone\". \n\n21) Input sanitisation errors in the \"Custsupport.html\", \"Main.html\",\nand \"Upsell.htm\" components can be exploited to inject arbitrary code\ninto the RealOneActiveXObject process and load unsafe controls. \n\n23) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to cause a heap-based\nbuffer overflow via an invalid size for an embedded MDPR chunk. \n\n24) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to corrupt heap memory\nvia an invalid number streams within the chunk. \n\n25) An input validation error when parsing the RMX file format can be\nexploited to cause a heap-based buffer overflow. \n\n26) An error when decoding data for particular mime types within a\nRealMedia file can be exploited to cause a heap-based buffer\noverflow. \n\n27) An error in the parsing of server headers can be exploited to\ncause a heap-based buffer overflow via an image tag pointing to a\nmalicious server, which causes the player to fetch a remote file. \n\n28) An error in the implementation of the Advanced Audio Coding\ncompression when decoding a conditional component of a data block\nwithin an AAC frame can be exploited to corrupt memory. \n\nSOLUTION:\nUpgrade to RealPlayer 14.0.0 or later. \n\nPROVIDED AND/OR DISCOVERED BY:\n1, 2) Alin Rad Pop, Secunia Research. \n3) Carsten Eiram, Secunia Research. \n4) Anonymous and Hossein Lotfi, reported via ZDI. \n5 - 11, 20, 21) Anonymous, reported via ZDI. \n12 - 14) The vendor credits Nicolas Joly, Vupen\n15) The vendor credits Chaouki Bekrar, Vupen\n17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs\n18, 19) Omair, reported via iDefense. \n22, 28) Damian Put, reported via ZDI. \n23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team\nlollersk8erz. \n25) Sebastian Apelt, reported via ZDI. \n26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. \n27) AbdulAziz Hariri, reported via ZDI. \n\nORIGINAL ADVISORY:\nSecunia Research:\nhttp://secunia.com/secunia_research/2010-9/\nhttp://secunia.com/secunia_research/2010-14/\nhttp://secunia.com/secunia_research/2010-15/\n\nRealNetworks:\nhttp://service.real.com/realplayer/security/12102010_player/en/\nhttp://realnetworksblog.com/?p=2216\n\nZDI:\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-268/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-266/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-270/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-273/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-269/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-271/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-272/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-274/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-275/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-276/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-277/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-278/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-279/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-281/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-280/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-282/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-267/\n\nTippingPoint DVLabs:\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html\n\niDefense Labs:\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. ZDI-10-271: RealNetworks RealPlayer RTSP GIF Parsing Remote Code Execution Vulnerability\n\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-271\n\nDecember 10, 2010\n\n-- CVE ID:\nCVE-2010-4376\n\n-- CVSS:\n9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)\n\n-- Affected Vendors:\nRealNetworks\n\n-- Affected Products:\nRealNetworks RealPlayer\n\n-- TippingPoint(TM) IPS Customer Protection:\nTippingPoint IPS customers have been protected against this\nvulnerability by Digital Vaccine protection filter ID 8308. \n\n-- Vendor Response:\nRealNetworks has issued an update to correct this vulnerability. More\ndetails can be found at:\n\nhttp://service.real.com/realplayer/security/12102010_player/en/\n\n-- Disclosure Timeline:\n2009-06-25 - Vulnerability reported to vendor\n2010-12-10 - Coordinated public release of advisory\n\n-- Credit:\nThis vulnerability was discovered by:\n * Anonymous\n\n-- About the Zero Day Initiative (ZDI):\nEstablished by TippingPoint, The Zero Day Initiative (ZDI) represents\na best-of-breed model for rewarding security researchers for responsibly\ndisclosing discovered vulnerabilities. \n\nResearchers interested in getting paid for their security research\nthrough the ZDI can find more information and sign-up at:\n\n http://www.zerodayinitiative.com\n\nThe ZDI is unique in how the acquired vulnerability information is\nused. TippingPoint does not re-sell the vulnerability details or any\nexploit code. Instead, upon notifying the affected product vendor,\nTippingPoint provides its customers with zero day protection through\nits intrusion prevention technology. Explicit details regarding the\nspecifics of the vulnerability are not exposed to any parties until\nan official vendor patch is publicly available. Furthermore, with the\naltruistic aim of helping to secure a broader user base, TippingPoint\nprovides this vulnerability information confidentially to security\nvendors (including competitors) who have a vulnerability protection or\nmitigation product. \n\nOur vulnerability disclosure policy is available online at:\n\n http://www.zerodayinitiative.com/advisories/disclosure_policy/\n\nFollow the ZDI on Twitter:\n\n http://twitter.com/thezdi\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4376"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002587"
},
{
"db": "ZDI",
"id": "ZDI-10-271"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45411"
},
{
"db": "VULHUB",
"id": "VHN-46981"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96593"
},
{
"db": "PACKETSTORM",
"id": "96637"
}
],
"trust": 3.15
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-46981",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46981"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-4376",
"trust": 3.6
},
{
"db": "ZDI",
"id": "ZDI-10-271",
"trust": 3.2
},
{
"db": "SECUNIA",
"id": "38550",
"trust": 1.6
},
{
"db": "SECUNIA",
"id": "42565",
"trust": 1.5
},
{
"db": "BID",
"id": "45411",
"trust": 1.4
},
{
"db": "SECTRACK",
"id": "1024861",
"trust": 1.1
},
{
"db": "VUPEN",
"id": "ADV-2010-3190",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002587",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-508",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201012-159",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-10-273",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-266",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-280",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-267",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-269",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-277",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-272",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-268",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-274",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-276",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-278",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-279",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-282",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-270",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-275",
"trust": 0.4
},
{
"db": "ZDI",
"id": "ZDI-10-281",
"trust": 0.4
},
{
"db": "BID",
"id": "45327",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "96593",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-46981",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96637",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-271"
},
{
"db": "VULHUB",
"id": "VHN-46981"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45411"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002587"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96593"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4376"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-159"
}
]
},
"id": "VAR-201012-0253",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-46981"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:10:58.584000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/ja"
},
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/en"
},
{
"title": "RealNetworks has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-271"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002587"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46981"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002587"
},
{
"db": "NVD",
"id": "CVE-2010-4376"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"trust": 2.4,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/38550"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/42565"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/45411"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id?1024861"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4376"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-4376"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2010/3190"
},
{
"trust": 0.6,
"url": "http://realnetworksblog.com/?p=2192"
},
{
"trust": 0.6,
"url": "http://dvlabs.tippingpoint.com/blog/2010/12/09/realnetworks-patches-27-vulnerabilities"
},
{
"trust": 0.6,
"url": "http://www.real.com/"
},
{
"trust": 0.4,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883"
},
{
"trust": 0.4,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884"
},
{
"trust": 0.3,
"url": "/archive/1/515235"
},
{
"trust": 0.3,
"url": "/archive/1/515236"
},
{
"trust": 0.3,
"url": "/archive/1/515238"
},
{
"trust": 0.3,
"url": "/archive/1/515237"
},
{
"trust": 0.3,
"url": "/archive/1/515234"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/advisory/tpti-10-18"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/advisory/tpti-10-19"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282"
},
{
"trust": 0.2,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.2,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.2,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.2,
"url": "http://realnetworksblog.com/?p=2216"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-14/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-15/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-9/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/#comments"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/disclosure_policy/"
},
{
"trust": 0.1,
"url": "http://twitter.com/thezdi"
},
{
"trust": 0.1,
"url": "http://www.tippingpoint.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-4376"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42565"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-10-271"
},
{
"db": "VULHUB",
"id": "VHN-46981"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45411"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002587"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96593"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4376"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-159"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-10-271"
},
{
"db": "VULHUB",
"id": "VHN-46981"
},
{
"db": "BID",
"id": "45327"
},
{
"db": "BID",
"id": "45411"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002587"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96593"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4376"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-159"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-10T00:00:00",
"db": "ZDI",
"id": "ZDI-10-271"
},
{
"date": "2010-12-14T00:00:00",
"db": "VULHUB",
"id": "VHN-46981"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45327"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45411"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002587"
},
{
"date": "2010-12-13T04:13:47",
"db": "PACKETSTORM",
"id": "96636"
},
{
"date": "2010-12-11T15:18:03",
"db": "PACKETSTORM",
"id": "96593"
},
{
"date": "2010-12-13T04:13:50",
"db": "PACKETSTORM",
"id": "96637"
},
{
"date": "2010-12-14T16:00:04.337000",
"db": "NVD",
"id": "CVE-2010-4376"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-159"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-10T00:00:00",
"db": "ZDI",
"id": "ZDI-10-271"
},
{
"date": "2011-01-19T00:00:00",
"db": "VULHUB",
"id": "VHN-46981"
},
{
"date": "2010-12-16T22:14:00",
"db": "BID",
"id": "45327"
},
{
"date": "2010-12-15T17:24:00",
"db": "BID",
"id": "45411"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002587"
},
{
"date": "2011-01-19T07:02:02.333000",
"db": "NVD",
"id": "CVE-2010-4376"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-159"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "96593"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-159"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer of RTSP GIF Heap-based buffer overflow vulnerability in the parsing process",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002587"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-159"
}
],
"trust": 0.6
}
}
VAR-201012-0242
Vulnerability from variot - Updated: 2023-12-18 12:10Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, RealPlayer Enterprise 2.1.2, and Mac RealPlayer 11.0 through 12.0.0.1444 allows remote attackers to have an unspecified impact via a crafted AAC file. RealNetworks RealPlayer Is AAC A heap overflow vulnerability exists.Details of the impact of this vulnerability are unknown. Real Networks RealPlayer is prone to a heap overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition. NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealPlayer is a software package released and maintained by Real Networks, which can be used to play multimedia files encoded in Real Media format. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial: http://secunia.com/products/corporate/vim/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38550
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/38550/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
RELEASE DATE: 2010-12-12
DISCUSS ADVISORY: http://secunia.com/advisories/38550/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/38550/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system.
1) An error exists when parsing RealAudio content encoded using the "cook" codec. This can be exploited to trigger the use of uninitialised memory and potentially cause a memory corruption via e.g. a specially crafted RealMedia file.
2) An error in the handling of errors encountered while decoding "cook"-encoded audio content can be exploited to trigger the use of uninitialised memory and potentially free an arbitrary address.
3) An error in the parsing of AAC audio content can be exploited to corrupt memory via specially crafted spectral data.
4) An array indexing error when parsing Media Properties Header (MDPR) in a RealMedia file can be exploited to corrupt memory.
5) An input validation error when parsing a RealMedia file can be exploited to cause a buffer overflow via a specially crafted multi-rate audio stream.
6) An error in the processing of the "StreamTitle" tag in a SHOUTcast stream using the ICY protocol can be exploited to cause an allocation failure for heap memory, which can result in the usage of freed pointers.
7) An integer overflow error when parsing a MLLT atom in an .AAC file can be exploited to cause a buffer overflow.
8) An input validation error in the "pnen3260.dll" module in the parsing of TIT2 atoms within AAC files can be exploited to corrupt memory.
9) An integer overflow in the parsing of GIF87a files over the streaming protocol RTSP can be exploited to cause a buffer overflow via a large "Screen Width" size in the "Screen Descriptor" header.
10) An error in the parsing of audio codec information in a Real Audio media file can be exploited to to cause a heap-based buffer overflow via a large number of subbands.
11) An input validation error in drv2.dll when decompressing RV20 video streams can be exploited to corrupt heap memory.
12) An unspecified error related to "SIPR" parsing can be exploited to corrupt heap memory.
13) An unspecified error related to "SOUND" processing can be exploited to corrupt heap memory.
14) An unspecified error related to "AAC" processing can be exploited to corrupt heap memory.
15) An unspecified error related to "RealMedia" processing can be exploited to corrupt heap memory.
16) An unspecified error related to "RA5" processing can be exploited to corrupt heap memory.
17) An integer overflow in "drv1.dll" when parsing SIPR stream metadata can be exploited to cause a heap-based buffer overflow, e.g. via the RealPlayer ActiveX control.
18) An input validation error in the processing of RealMedia files can be exploited to corrupt heap memory.
19) An input validation error in the RealAudio codec when processing RealMedia files can be exploited to corrupt heap memory.
20) An error in the "HandleAction" method in the RealPlayer ActiveX control allows users to download and execute scripts in the "Local Zone".
21) Input sanitisation errors in the "Custsupport.html", "Main.html", and "Upsell.htm" components can be exploited to inject arbitrary code into the RealOneActiveXObject process and load unsafe controls.
22) A boundary error in the parsing of cook-specific data used for initialization can be exploited to cause a heap-based buffer overflow.
23) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to cause a heap-based buffer overflow via an invalid size for an embedded MDPR chunk.
24) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to corrupt heap memory via an invalid number streams within the chunk.
25) An input validation error when parsing the RMX file format can be exploited to cause a heap-based buffer overflow.
26) An error when decoding data for particular mime types within a RealMedia file can be exploited to cause a heap-based buffer overflow.
27) An error in the parsing of server headers can be exploited to cause a heap-based buffer overflow via an image tag pointing to a malicious server, which causes the player to fetch a remote file.
28) An error in the implementation of the Advanced Audio Coding compression when decoding a conditional component of a data block within an AAC frame can be exploited to corrupt memory.
SOLUTION: Upgrade to RealPlayer 14.0.0 or later.
PROVIDED AND/OR DISCOVERED BY: 1, 2) Alin Rad Pop, Secunia Research. 3) Carsten Eiram, Secunia Research. 4) Anonymous and Hossein Lotfi, reported via ZDI. 5 - 11, 20, 21) Anonymous, reported via ZDI. 12 - 14) The vendor credits Nicolas Joly, Vupen 15) The vendor credits Chaouki Bekrar, Vupen 17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs 18, 19) Omair, reported via iDefense. 22, 28) Damian Put, reported via ZDI. 23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team lollersk8erz. 25) Sebastian Apelt, reported via ZDI. 26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. 27) AbdulAziz Hariri, reported via ZDI.
ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2010-9/ http://secunia.com/secunia_research/2010-14/ http://secunia.com/secunia_research/2010-15/
RealNetworks: http://service.real.com/realplayer/security/12102010_player/en/ http://realnetworksblog.com/?p=2216
ZDI: http://www.zerodayinitiative.com/advisories/ZDI-10-268/ http://www.zerodayinitiative.com/advisories/ZDI-10-266/ http://www.zerodayinitiative.com/advisories/ZDI-10-270/ http://www.zerodayinitiative.com/advisories/ZDI-10-273/ http://www.zerodayinitiative.com/advisories/ZDI-10-269/ http://www.zerodayinitiative.com/advisories/ZDI-10-271/ http://www.zerodayinitiative.com/advisories/ZDI-10-272/ http://www.zerodayinitiative.com/advisories/ZDI-10-274/ http://www.zerodayinitiative.com/advisories/ZDI-10-275/ http://www.zerodayinitiative.com/advisories/ZDI-10-276/ http://www.zerodayinitiative.com/advisories/ZDI-10-277/ http://www.zerodayinitiative.com/advisories/ZDI-10-278/ http://www.zerodayinitiative.com/advisories/ZDI-10-279/ http://www.zerodayinitiative.com/advisories/ZDI-10-281/ http://www.zerodayinitiative.com/advisories/ZDI-10-280/ http://www.zerodayinitiative.com/advisories/ZDI-10-282/ http://www.zerodayinitiative.com/advisories/ZDI-10-267/
TippingPoint DVLabs: http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html
iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201012-0242",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "1.1.4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "1.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1.3"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "2.1.2"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "(enterprise) 2.1.2"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "12.0.0.1444 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0 to 1.0.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.2 to 1.1.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.1.2 to 1.1.4"
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.2"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "116.0.14.550"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer for mac",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "12.0.0.1548"
},
{
"model": "realplayer enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.4"
},
{
"model": "realplayer",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "14.0.1"
}
],
"sources": [
{
"db": "BID",
"id": "45425"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002595"
},
{
"db": "NVD",
"id": "CVE-2010-4381"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-154"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:12.0.0.1444:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:2.1.2:*:enterprise:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4381"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Nicolas Joly of VUPEN Vulnerability Research Team",
"sources": [
{
"db": "BID",
"id": "45425"
}
],
"trust": 0.3
},
"cve": "CVE-2010-4381",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-4381",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-46986",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-4381",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201012-154",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-46986",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46986"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002595"
},
{
"db": "NVD",
"id": "CVE-2010-4381"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-154"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, RealPlayer Enterprise 2.1.2, and Mac RealPlayer 11.0 through 12.0.0.1444 allows remote attackers to have an unspecified impact via a crafted AAC file. RealNetworks RealPlayer Is AAC A heap overflow vulnerability exists.Details of the impact of this vulnerability are unknown. Real Networks RealPlayer is prone to a heap overflow vulnerability because the software fails to perform adequate boundary-checks on user-supplied data. \nSuccessfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition. \nNOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealPlayer is a software package released and maintained by Real Networks, which can be used to play multimedia files encoded in Real Media format. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nRequest a free trial: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38550\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/38550/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nRELEASE DATE:\n2010-12-12\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/38550/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/38550/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in RealPlayer, which can\nbe exploited by malicious people to compromise a user\u0027s system. \n\n1) An error exists when parsing RealAudio content encoded using the\n\"cook\" codec. This can be exploited to trigger the use of\nuninitialised memory and potentially cause a memory corruption via\ne.g. a specially crafted RealMedia file. \n\n2) An error in the handling of errors encountered while decoding\n\"cook\"-encoded audio content can be exploited to trigger the use of\nuninitialised memory and potentially free an arbitrary address. \n\n3) An error in the parsing of AAC audio content can be exploited to\ncorrupt memory via specially crafted spectral data. \n\n4) An array indexing error when parsing Media Properties Header\n(MDPR) in a RealMedia file can be exploited to corrupt memory. \n\n5) An input validation error when parsing a RealMedia file can be\nexploited to cause a buffer overflow via a specially crafted\nmulti-rate audio stream. \n\n6) An error in the processing of the \"StreamTitle\" tag in a SHOUTcast\nstream using the ICY protocol can be exploited to cause an allocation\nfailure for heap memory, which can result in the usage of freed\npointers. \n\n7) An integer overflow error when parsing a MLLT atom in an .AAC file\ncan be exploited to cause a buffer overflow. \n\n8) An input validation error in the \"pnen3260.dll\" module in the\nparsing of TIT2 atoms within AAC files can be exploited to corrupt\nmemory. \n\n9) An integer overflow in the parsing of GIF87a files over the\nstreaming protocol RTSP can be exploited to cause a buffer overflow\nvia a large \"Screen Width\" size in the \"Screen Descriptor\" header. \n\n10) An error in the parsing of audio codec information in a Real\nAudio media file can be exploited to to cause a heap-based buffer\noverflow via a large number of subbands. \n\n11) An input validation error in drv2.dll when decompressing RV20\nvideo streams can be exploited to corrupt heap memory. \n\n12) An unspecified error related to \"SIPR\" parsing can be exploited\nto corrupt heap memory. \n\n13) An unspecified error related to \"SOUND\" processing can be\nexploited to corrupt heap memory. \n\n14) An unspecified error related to \"AAC\" processing can be exploited\nto corrupt heap memory. \n\n15) An unspecified error related to \"RealMedia\" processing can be\nexploited to corrupt heap memory. \n\n16) An unspecified error related to \"RA5\" processing can be exploited\nto corrupt heap memory. \n\n17) An integer overflow in \"drv1.dll\" when parsing SIPR stream\nmetadata can be exploited to cause a heap-based buffer overflow, e.g. \nvia the RealPlayer ActiveX control. \n\n18) An input validation error in the processing of RealMedia files\ncan be exploited to corrupt heap memory. \n\n19) An input validation error in the RealAudio codec when processing\nRealMedia files can be exploited to corrupt heap memory. \n\n20) An error in the \"HandleAction\" method in the RealPlayer ActiveX\ncontrol allows users to download and execute scripts in the \"Local\nZone\". \n\n21) Input sanitisation errors in the \"Custsupport.html\", \"Main.html\",\nand \"Upsell.htm\" components can be exploited to inject arbitrary code\ninto the RealOneActiveXObject process and load unsafe controls. \n\n22) A boundary error in the parsing of cook-specific data used for\ninitialization can be exploited to cause a heap-based buffer\noverflow. \n\n23) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to cause a heap-based\nbuffer overflow via an invalid size for an embedded MDPR chunk. \n\n24) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to corrupt heap memory\nvia an invalid number streams within the chunk. \n\n25) An input validation error when parsing the RMX file format can be\nexploited to cause a heap-based buffer overflow. \n\n26) An error when decoding data for particular mime types within a\nRealMedia file can be exploited to cause a heap-based buffer\noverflow. \n\n27) An error in the parsing of server headers can be exploited to\ncause a heap-based buffer overflow via an image tag pointing to a\nmalicious server, which causes the player to fetch a remote file. \n\n28) An error in the implementation of the Advanced Audio Coding\ncompression when decoding a conditional component of a data block\nwithin an AAC frame can be exploited to corrupt memory. \n\nSOLUTION:\nUpgrade to RealPlayer 14.0.0 or later. \n\nPROVIDED AND/OR DISCOVERED BY:\n1, 2) Alin Rad Pop, Secunia Research. \n3) Carsten Eiram, Secunia Research. \n4) Anonymous and Hossein Lotfi, reported via ZDI. \n5 - 11, 20, 21) Anonymous, reported via ZDI. \n12 - 14) The vendor credits Nicolas Joly, Vupen\n15) The vendor credits Chaouki Bekrar, Vupen\n17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs\n18, 19) Omair, reported via iDefense. \n22, 28) Damian Put, reported via ZDI. \n23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team\nlollersk8erz. \n25) Sebastian Apelt, reported via ZDI. \n26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. \n27) AbdulAziz Hariri, reported via ZDI. \n\nORIGINAL ADVISORY:\nSecunia Research:\nhttp://secunia.com/secunia_research/2010-9/\nhttp://secunia.com/secunia_research/2010-14/\nhttp://secunia.com/secunia_research/2010-15/\n\nRealNetworks:\nhttp://service.real.com/realplayer/security/12102010_player/en/\nhttp://realnetworksblog.com/?p=2216\n\nZDI:\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-268/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-266/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-270/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-273/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-269/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-271/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-272/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-274/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-275/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-276/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-277/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-278/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-279/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-281/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-280/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-282/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-267/\n\nTippingPoint DVLabs:\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html\n\niDefense Labs:\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4381"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002595"
},
{
"db": "BID",
"id": "45425"
},
{
"db": "VULHUB",
"id": "VHN-46986"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96639"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-4381",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "38550",
"trust": 1.6
},
{
"db": "SECTRACK",
"id": "1024861",
"trust": 1.1
},
{
"db": "VUPEN",
"id": "ADV-2010-3190",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002595",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201012-154",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "42512",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "42333",
"trust": 0.7
},
{
"db": "BID",
"id": "45425",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-46986",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-268",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-273",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-272",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-267",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-276",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-269",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-280",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-282",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-278",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-277",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-271",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-274",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-266",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-281",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-279",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-270",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-275",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96640",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96639",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46986"
},
{
"db": "BID",
"id": "45425"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002595"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "NVD",
"id": "CVE-2010-4381"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-154"
}
]
},
"id": "VAR-201012-0242",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-46986"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:10:58.436000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/ja"
},
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/en"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002595"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46986"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002595"
},
{
"db": "NVD",
"id": "CVE-2010-4381"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/38550"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id?1024861"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4381"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-4381"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2010/3190"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/42333"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/42512"
},
{
"trust": 0.3,
"url": "http://realnetworksblog.com/?p=2192"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/blog/2010/12/09/realnetworks-patches-27-vulnerabilities"
},
{
"trust": 0.3,
"url": "http://www.real.com/"
},
{
"trust": 0.3,
"url": "/archive/1/515235"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.3,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.3,
"url": "http://realnetworksblog.com/?p=2216"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-14/"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-15/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-9/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/#comments"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42512/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42512"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42512/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42333"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42333/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42333/#comments"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46986"
},
{
"db": "BID",
"id": "45425"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002595"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "NVD",
"id": "CVE-2010-4381"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-154"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-46986"
},
{
"db": "BID",
"id": "45425"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002595"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "NVD",
"id": "CVE-2010-4381"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-154"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-14T00:00:00",
"db": "VULHUB",
"id": "VHN-46986"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45425"
},
{
"date": "2011-01-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002595"
},
{
"date": "2010-12-13T04:13:47",
"db": "PACKETSTORM",
"id": "96636"
},
{
"date": "2010-12-13T04:13:58",
"db": "PACKETSTORM",
"id": "96640"
},
{
"date": "2010-12-13T04:13:55",
"db": "PACKETSTORM",
"id": "96639"
},
{
"date": "2010-12-14T16:00:04.537000",
"db": "NVD",
"id": "CVE-2010-4381"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-154"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-01-19T00:00:00",
"db": "VULHUB",
"id": "VHN-46986"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45425"
},
{
"date": "2011-01-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002595"
},
{
"date": "2011-01-19T07:02:03.147000",
"db": "NVD",
"id": "CVE-2010-4381"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-154"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-154"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer In AAC Heap overflow vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002595"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-154"
}
],
"trust": 0.6
}
}
VAR-201012-0244
Vulnerability from variot - Updated: 2023-12-18 12:10Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, RealPlayer Enterprise 2.1.2, Mac RealPlayer 11.0 through 12.0.0.1444, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to have an unspecified impact via a crafted RA5 file. RealNetworks RealPlayer Is RA5 A heap overflow vulnerability exists.Details of the impact of this vulnerability are unknown. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition. NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial: http://secunia.com/products/corporate/vim/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38550
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/38550/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
RELEASE DATE: 2010-12-12
DISCUSS ADVISORY: http://secunia.com/advisories/38550/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/38550/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system.
1) An error exists when parsing RealAudio content encoded using the "cook" codec. This can be exploited to trigger the use of uninitialised memory and potentially cause a memory corruption via e.g. a specially crafted RealMedia file.
2) An error in the handling of errors encountered while decoding "cook"-encoded audio content can be exploited to trigger the use of uninitialised memory and potentially free an arbitrary address.
3) An error in the parsing of AAC audio content can be exploited to corrupt memory via specially crafted spectral data.
4) An array indexing error when parsing Media Properties Header (MDPR) in a RealMedia file can be exploited to corrupt memory.
5) An input validation error when parsing a RealMedia file can be exploited to cause a buffer overflow via a specially crafted multi-rate audio stream.
6) An error in the processing of the "StreamTitle" tag in a SHOUTcast stream using the ICY protocol can be exploited to cause an allocation failure for heap memory, which can result in the usage of freed pointers.
7) An integer overflow error when parsing a MLLT atom in an .AAC file can be exploited to cause a buffer overflow.
8) An input validation error in the "pnen3260.dll" module in the parsing of TIT2 atoms within AAC files can be exploited to corrupt memory.
9) An integer overflow in the parsing of GIF87a files over the streaming protocol RTSP can be exploited to cause a buffer overflow via a large "Screen Width" size in the "Screen Descriptor" header.
10) An error in the parsing of audio codec information in a Real Audio media file can be exploited to to cause a heap-based buffer overflow via a large number of subbands.
11) An input validation error in drv2.dll when decompressing RV20 video streams can be exploited to corrupt heap memory.
12) An unspecified error related to "SIPR" parsing can be exploited to corrupt heap memory.
13) An unspecified error related to "SOUND" processing can be exploited to corrupt heap memory.
14) An unspecified error related to "AAC" processing can be exploited to corrupt heap memory.
15) An unspecified error related to "RealMedia" processing can be exploited to corrupt heap memory.
16) An unspecified error related to "RA5" processing can be exploited to corrupt heap memory.
17) An integer overflow in "drv1.dll" when parsing SIPR stream metadata can be exploited to cause a heap-based buffer overflow, e.g. via the RealPlayer ActiveX control.
18) An input validation error in the processing of RealMedia files can be exploited to corrupt heap memory.
19) An input validation error in the RealAudio codec when processing RealMedia files can be exploited to corrupt heap memory.
20) An error in the "HandleAction" method in the RealPlayer ActiveX control allows users to download and execute scripts in the "Local Zone".
21) Input sanitisation errors in the "Custsupport.html", "Main.html", and "Upsell.htm" components can be exploited to inject arbitrary code into the RealOneActiveXObject process and load unsafe controls.
22) A boundary error in the parsing of cook-specific data used for initialization can be exploited to cause a heap-based buffer overflow.
23) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to cause a heap-based buffer overflow via an invalid size for an embedded MDPR chunk.
24) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to corrupt heap memory via an invalid number streams within the chunk.
25) An input validation error when parsing the RMX file format can be exploited to cause a heap-based buffer overflow.
26) An error when decoding data for particular mime types within a RealMedia file can be exploited to cause a heap-based buffer overflow.
27) An error in the parsing of server headers can be exploited to cause a heap-based buffer overflow via an image tag pointing to a malicious server, which causes the player to fetch a remote file.
28) An error in the implementation of the Advanced Audio Coding compression when decoding a conditional component of a data block within an AAC frame can be exploited to corrupt memory.
SOLUTION: Upgrade to RealPlayer 14.0.0 or later.
PROVIDED AND/OR DISCOVERED BY: 1, 2) Alin Rad Pop, Secunia Research. 3) Carsten Eiram, Secunia Research. 4) Anonymous and Hossein Lotfi, reported via ZDI. 5 - 11, 20, 21) Anonymous, reported via ZDI. 12 - 14) The vendor credits Nicolas Joly, Vupen 15) The vendor credits Chaouki Bekrar, Vupen 17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs 18, 19) Omair, reported via iDefense. 22, 28) Damian Put, reported via ZDI. 23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team lollersk8erz. 25) Sebastian Apelt, reported via ZDI. 26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. 27) AbdulAziz Hariri, reported via ZDI.
ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2010-9/ http://secunia.com/secunia_research/2010-14/ http://secunia.com/secunia_research/2010-15/
RealNetworks: http://service.real.com/realplayer/security/12102010_player/en/ http://realnetworksblog.com/?p=2216
ZDI: http://www.zerodayinitiative.com/advisories/ZDI-10-268/ http://www.zerodayinitiative.com/advisories/ZDI-10-266/ http://www.zerodayinitiative.com/advisories/ZDI-10-270/ http://www.zerodayinitiative.com/advisories/ZDI-10-273/ http://www.zerodayinitiative.com/advisories/ZDI-10-269/ http://www.zerodayinitiative.com/advisories/ZDI-10-271/ http://www.zerodayinitiative.com/advisories/ZDI-10-272/ http://www.zerodayinitiative.com/advisories/ZDI-10-274/ http://www.zerodayinitiative.com/advisories/ZDI-10-275/ http://www.zerodayinitiative.com/advisories/ZDI-10-276/ http://www.zerodayinitiative.com/advisories/ZDI-10-277/ http://www.zerodayinitiative.com/advisories/ZDI-10-278/ http://www.zerodayinitiative.com/advisories/ZDI-10-279/ http://www.zerodayinitiative.com/advisories/ZDI-10-281/ http://www.zerodayinitiative.com/advisories/ZDI-10-280/ http://www.zerodayinitiative.com/advisories/ZDI-10-282/ http://www.zerodayinitiative.com/advisories/ZDI-10-267/
TippingPoint DVLabs: http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html
iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201012-0244",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.9,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "2.1.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1.4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1.3"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.3,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "(enterprise) 2.1.2"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0.2.1744 (linux)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "12.0.0.1444 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0 to 1.0.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.2 to 1.1.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.1.2 to 1.1.4"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (es)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.0"
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1.0"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.2"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "116.0.14.550"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.1.3114"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.9"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.8"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.7"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.6"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.5"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.4"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.3"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.2"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "1010.0.1"
},
{
"model": "realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "10"
},
{
"model": "realplayer beta",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11"
},
{
"model": "realplayer for mac",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "12.0.0.1548"
},
{
"model": "realplayer for linux",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "11.0.2.2315"
},
{
"model": "realplayer enterprise",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "2.1.4"
},
{
"model": "realplayer",
"scope": "ne",
"trust": 0.3,
"vendor": "realnetworks",
"version": "14.0.1"
}
],
"sources": [
{
"db": "BID",
"id": "45429"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002597"
},
{
"db": "NVD",
"id": "CVE-2010-4383"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-152"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:12.0.0.1444:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:2.1.2:*:enterprise:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4383"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Secunia",
"sources": [
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96637"
}
],
"trust": 0.4
},
"cve": "CVE-2010-4383",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-4383",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-46988",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-4383",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201012-152",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-46988",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46988"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002597"
},
{
"db": "NVD",
"id": "CVE-2010-4383"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-152"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, RealPlayer Enterprise 2.1.2, Mac RealPlayer 11.0 through 12.0.0.1444, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to have an unspecified impact via a crafted RA5 file. RealNetworks RealPlayer Is RA5 A heap overflow vulnerability exists.Details of the impact of this vulnerability are unknown. \nSuccessfully exploiting this issue allows attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition. \nNOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealNetworks RealNetworks RealPlayer is a set of media player products developed by RealNetworks in the United States. The product provides features for downloading/converting videos (in web pages), editing videos, managing media files, and more. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nRequest a free trial: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38550\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/38550/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nRELEASE DATE:\n2010-12-12\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/38550/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/38550/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in RealPlayer, which can\nbe exploited by malicious people to compromise a user\u0027s system. \n\n1) An error exists when parsing RealAudio content encoded using the\n\"cook\" codec. This can be exploited to trigger the use of\nuninitialised memory and potentially cause a memory corruption via\ne.g. a specially crafted RealMedia file. \n\n2) An error in the handling of errors encountered while decoding\n\"cook\"-encoded audio content can be exploited to trigger the use of\nuninitialised memory and potentially free an arbitrary address. \n\n3) An error in the parsing of AAC audio content can be exploited to\ncorrupt memory via specially crafted spectral data. \n\n4) An array indexing error when parsing Media Properties Header\n(MDPR) in a RealMedia file can be exploited to corrupt memory. \n\n5) An input validation error when parsing a RealMedia file can be\nexploited to cause a buffer overflow via a specially crafted\nmulti-rate audio stream. \n\n6) An error in the processing of the \"StreamTitle\" tag in a SHOUTcast\nstream using the ICY protocol can be exploited to cause an allocation\nfailure for heap memory, which can result in the usage of freed\npointers. \n\n7) An integer overflow error when parsing a MLLT atom in an .AAC file\ncan be exploited to cause a buffer overflow. \n\n8) An input validation error in the \"pnen3260.dll\" module in the\nparsing of TIT2 atoms within AAC files can be exploited to corrupt\nmemory. \n\n9) An integer overflow in the parsing of GIF87a files over the\nstreaming protocol RTSP can be exploited to cause a buffer overflow\nvia a large \"Screen Width\" size in the \"Screen Descriptor\" header. \n\n10) An error in the parsing of audio codec information in a Real\nAudio media file can be exploited to to cause a heap-based buffer\noverflow via a large number of subbands. \n\n11) An input validation error in drv2.dll when decompressing RV20\nvideo streams can be exploited to corrupt heap memory. \n\n12) An unspecified error related to \"SIPR\" parsing can be exploited\nto corrupt heap memory. \n\n13) An unspecified error related to \"SOUND\" processing can be\nexploited to corrupt heap memory. \n\n14) An unspecified error related to \"AAC\" processing can be exploited\nto corrupt heap memory. \n\n15) An unspecified error related to \"RealMedia\" processing can be\nexploited to corrupt heap memory. \n\n16) An unspecified error related to \"RA5\" processing can be exploited\nto corrupt heap memory. \n\n17) An integer overflow in \"drv1.dll\" when parsing SIPR stream\nmetadata can be exploited to cause a heap-based buffer overflow, e.g. \nvia the RealPlayer ActiveX control. \n\n18) An input validation error in the processing of RealMedia files\ncan be exploited to corrupt heap memory. \n\n19) An input validation error in the RealAudio codec when processing\nRealMedia files can be exploited to corrupt heap memory. \n\n20) An error in the \"HandleAction\" method in the RealPlayer ActiveX\ncontrol allows users to download and execute scripts in the \"Local\nZone\". \n\n21) Input sanitisation errors in the \"Custsupport.html\", \"Main.html\",\nand \"Upsell.htm\" components can be exploited to inject arbitrary code\ninto the RealOneActiveXObject process and load unsafe controls. \n\n22) A boundary error in the parsing of cook-specific data used for\ninitialization can be exploited to cause a heap-based buffer\noverflow. \n\n23) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to cause a heap-based\nbuffer overflow via an invalid size for an embedded MDPR chunk. \n\n24) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to corrupt heap memory\nvia an invalid number streams within the chunk. \n\n25) An input validation error when parsing the RMX file format can be\nexploited to cause a heap-based buffer overflow. \n\n26) An error when decoding data for particular mime types within a\nRealMedia file can be exploited to cause a heap-based buffer\noverflow. \n\n27) An error in the parsing of server headers can be exploited to\ncause a heap-based buffer overflow via an image tag pointing to a\nmalicious server, which causes the player to fetch a remote file. \n\n28) An error in the implementation of the Advanced Audio Coding\ncompression when decoding a conditional component of a data block\nwithin an AAC frame can be exploited to corrupt memory. \n\nSOLUTION:\nUpgrade to RealPlayer 14.0.0 or later. \n\nPROVIDED AND/OR DISCOVERED BY:\n1, 2) Alin Rad Pop, Secunia Research. \n3) Carsten Eiram, Secunia Research. \n4) Anonymous and Hossein Lotfi, reported via ZDI. \n5 - 11, 20, 21) Anonymous, reported via ZDI. \n12 - 14) The vendor credits Nicolas Joly, Vupen\n15) The vendor credits Chaouki Bekrar, Vupen\n17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs\n18, 19) Omair, reported via iDefense. \n22, 28) Damian Put, reported via ZDI. \n23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team\nlollersk8erz. \n25) Sebastian Apelt, reported via ZDI. \n26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. \n27) AbdulAziz Hariri, reported via ZDI. \n\nORIGINAL ADVISORY:\nSecunia Research:\nhttp://secunia.com/secunia_research/2010-9/\nhttp://secunia.com/secunia_research/2010-14/\nhttp://secunia.com/secunia_research/2010-15/\n\nRealNetworks:\nhttp://service.real.com/realplayer/security/12102010_player/en/\nhttp://realnetworksblog.com/?p=2216\n\nZDI:\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-268/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-266/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-270/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-273/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-269/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-271/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-272/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-274/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-275/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-276/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-277/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-278/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-279/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-281/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-280/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-282/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-267/\n\nTippingPoint DVLabs:\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html\n\niDefense Labs:\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-4383"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002597"
},
{
"db": "BID",
"id": "45429"
},
{
"db": "VULHUB",
"id": "VHN-46988"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96637"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-4383",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "38550",
"trust": 1.6
},
{
"db": "SECUNIA",
"id": "42565",
"trust": 1.5
},
{
"db": "SECTRACK",
"id": "1024861",
"trust": 1.1
},
{
"db": "VUPEN",
"id": "ADV-2010-3190",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002597",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201012-152",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "42512",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "42333",
"trust": 0.7
},
{
"db": "BID",
"id": "45429",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-46988",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-268",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-273",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-272",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-267",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-276",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-269",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-280",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-282",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-278",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-277",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-271",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-274",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-266",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-281",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-279",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-270",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-275",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96640",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96639",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96637",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46988"
},
{
"db": "BID",
"id": "45429"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002597"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4383"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-152"
}
]
},
"id": "VAR-201012-0244",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-46988"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:10:58.480000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/ja"
},
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/en"
},
{
"title": "RHSA-2010:0981",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2010-0981.html"
},
{
"title": "RealPlayerSP",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35884"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35883"
},
{
"title": "RealPlayer11GOLD",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35882"
},
{
"title": "RealPlayer",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=35881"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002597"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-152"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46988"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002597"
},
{
"db": "NVD",
"id": "CVE-2010-4383"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/38550"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/42565"
},
{
"trust": 1.1,
"url": "http://www.redhat.com/support/errata/rhsa-2010-0981.html"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id?1024861"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4383"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-4383"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2010/3190"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/42512"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/42333"
},
{
"trust": 0.4,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.4,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.4,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.4,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.4,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.4,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.4,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.4,
"url": "http://realnetworksblog.com/?p=2216"
},
{
"trust": 0.3,
"url": "http://realnetworksblog.com/?p=2192"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/blog/2010/12/09/realnetworks-patches-27-vulnerabilities"
},
{
"trust": 0.3,
"url": "http://www.real.com/"
},
{
"trust": 0.3,
"url": "/archive/1/515238"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-14/"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-15/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-9/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/#comments"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42512/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42512"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42512/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42333"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42333/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42333/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42565"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-46988"
},
{
"db": "BID",
"id": "45429"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002597"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4383"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-152"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-46988"
},
{
"db": "BID",
"id": "45429"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002597"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96639"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-4383"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-152"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-14T00:00:00",
"db": "VULHUB",
"id": "VHN-46988"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45429"
},
{
"date": "2011-01-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002597"
},
{
"date": "2010-12-13T04:13:47",
"db": "PACKETSTORM",
"id": "96636"
},
{
"date": "2010-12-13T04:13:58",
"db": "PACKETSTORM",
"id": "96640"
},
{
"date": "2010-12-13T04:13:55",
"db": "PACKETSTORM",
"id": "96639"
},
{
"date": "2010-12-13T04:13:50",
"db": "PACKETSTORM",
"id": "96637"
},
{
"date": "2010-12-14T16:00:04.600000",
"db": "NVD",
"id": "CVE-2010-4383"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-152"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-01-26T00:00:00",
"db": "VULHUB",
"id": "VHN-46988"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45429"
},
{
"date": "2011-01-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002597"
},
{
"date": "2011-01-26T06:52:15.493000",
"db": "NVD",
"id": "CVE-2010-4383"
},
{
"date": "2011-07-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-152"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-152"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer In RA5 Heap overflow vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002597"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-152"
}
],
"trust": 0.6
}
}
VAR-201012-0017
Vulnerability from variot - Updated: 2023-12-18 12:10The cook codec in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, Mac RealPlayer 11.0 through 12.0.0.1444, and Linux RealPlayer 11.0.2.1744 does not properly perform initialization, which has unspecified impact and attack vectors. Real Networks RealPlayer is prone to a memory corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. NOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealPlayer is a software package released and maintained by Real Networks, which can be used to play multimedia files encoded in Real Media format. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial: http://secunia.com/products/corporate/vim/
TITLE: RealPlayer Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA38550
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/38550/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
RELEASE DATE: 2010-12-12
DISCUSS ADVISORY: http://secunia.com/advisories/38550/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/38550/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=38550
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in RealPlayer, which can be exploited by malicious people to compromise a user's system.
1) An error exists when parsing RealAudio content encoded using the "cook" codec. This can be exploited to trigger the use of uninitialised memory and potentially cause a memory corruption via e.g. a specially crafted RealMedia file.
2) An error in the handling of errors encountered while decoding "cook"-encoded audio content can be exploited to trigger the use of uninitialised memory and potentially free an arbitrary address.
3) An error in the parsing of AAC audio content can be exploited to corrupt memory via specially crafted spectral data.
4) An array indexing error when parsing Media Properties Header (MDPR) in a RealMedia file can be exploited to corrupt memory.
5) An input validation error when parsing a RealMedia file can be exploited to cause a buffer overflow via a specially crafted multi-rate audio stream.
6) An error in the processing of the "StreamTitle" tag in a SHOUTcast stream using the ICY protocol can be exploited to cause an allocation failure for heap memory, which can result in the usage of freed pointers.
7) An integer overflow error when parsing a MLLT atom in an .AAC file can be exploited to cause a buffer overflow.
8) An input validation error in the "pnen3260.dll" module in the parsing of TIT2 atoms within AAC files can be exploited to corrupt memory.
9) An integer overflow in the parsing of GIF87a files over the streaming protocol RTSP can be exploited to cause a buffer overflow via a large "Screen Width" size in the "Screen Descriptor" header.
10) An error in the parsing of audio codec information in a Real Audio media file can be exploited to to cause a heap-based buffer overflow via a large number of subbands.
11) An input validation error in drv2.dll when decompressing RV20 video streams can be exploited to corrupt heap memory.
12) An unspecified error related to "SIPR" parsing can be exploited to corrupt heap memory.
13) An unspecified error related to "SOUND" processing can be exploited to corrupt heap memory.
14) An unspecified error related to "AAC" processing can be exploited to corrupt heap memory.
15) An unspecified error related to "RealMedia" processing can be exploited to corrupt heap memory.
16) An unspecified error related to "RA5" processing can be exploited to corrupt heap memory.
17) An integer overflow in "drv1.dll" when parsing SIPR stream metadata can be exploited to cause a heap-based buffer overflow, e.g. via the RealPlayer ActiveX control.
18) An input validation error in the processing of RealMedia files can be exploited to corrupt heap memory.
19) An input validation error in the RealAudio codec when processing RealMedia files can be exploited to corrupt heap memory.
20) An error in the "HandleAction" method in the RealPlayer ActiveX control allows users to download and execute scripts in the "Local Zone".
21) Input sanitisation errors in the "Custsupport.html", "Main.html", and "Upsell.htm" components can be exploited to inject arbitrary code into the RealOneActiveXObject process and load unsafe controls.
22) A boundary error in the parsing of cook-specific data used for initialization can be exploited to cause a heap-based buffer overflow.
23) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to cause a heap-based buffer overflow via an invalid size for an embedded MDPR chunk.
24) An error in the parsing of MLTI chunks when processing Internet Video Recording (.ivr) files can be exploited to corrupt heap memory via an invalid number streams within the chunk.
25) An input validation error when parsing the RMX file format can be exploited to cause a heap-based buffer overflow.
26) An error when decoding data for particular mime types within a RealMedia file can be exploited to cause a heap-based buffer overflow.
27) An error in the parsing of server headers can be exploited to cause a heap-based buffer overflow via an image tag pointing to a malicious server, which causes the player to fetch a remote file.
28) An error in the implementation of the Advanced Audio Coding compression when decoding a conditional component of a data block within an AAC frame can be exploited to corrupt memory.
Successful exploitation of the vulnerabilities may allow execution of arbitrary code.
SOLUTION: Upgrade to RealPlayer 14.0.0 or later.
PROVIDED AND/OR DISCOVERED BY: 1, 2) Alin Rad Pop, Secunia Research. 3) Carsten Eiram, Secunia Research. 4) Anonymous and Hossein Lotfi, reported via ZDI. 5 - 11, 20, 21) Anonymous, reported via ZDI. 12 - 14) The vendor credits Nicolas Joly, Vupen 15) The vendor credits Chaouki Bekrar, Vupen 17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs 18, 19) Omair, reported via iDefense. 22, 28) Damian Put, reported via ZDI. 23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team lollersk8erz. 25) Sebastian Apelt, reported via ZDI. 26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. 27) AbdulAziz Hariri, reported via ZDI.
ORIGINAL ADVISORY: Secunia Research: http://secunia.com/secunia_research/2010-9/ http://secunia.com/secunia_research/2010-14/ http://secunia.com/secunia_research/2010-15/
RealNetworks: http://service.real.com/realplayer/security/12102010_player/en/ http://realnetworksblog.com/?p=2216
ZDI: http://www.zerodayinitiative.com/advisories/ZDI-10-268/ http://www.zerodayinitiative.com/advisories/ZDI-10-266/ http://www.zerodayinitiative.com/advisories/ZDI-10-270/ http://www.zerodayinitiative.com/advisories/ZDI-10-273/ http://www.zerodayinitiative.com/advisories/ZDI-10-269/ http://www.zerodayinitiative.com/advisories/ZDI-10-271/ http://www.zerodayinitiative.com/advisories/ZDI-10-272/ http://www.zerodayinitiative.com/advisories/ZDI-10-274/ http://www.zerodayinitiative.com/advisories/ZDI-10-275/ http://www.zerodayinitiative.com/advisories/ZDI-10-276/ http://www.zerodayinitiative.com/advisories/ZDI-10-277/ http://www.zerodayinitiative.com/advisories/ZDI-10-278/ http://www.zerodayinitiative.com/advisories/ZDI-10-279/ http://www.zerodayinitiative.com/advisories/ZDI-10-281/ http://www.zerodayinitiative.com/advisories/ZDI-10-280/ http://www.zerodayinitiative.com/advisories/ZDI-10-282/ http://www.zerodayinitiative.com/advisories/ZDI-10-267/
TippingPoint DVLabs: http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html
iDefense Labs: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
.
====================================================================== 2) Severity
Rating: Highly critical Impact: System access Where: From remote
====================================================================== 3) Vendor's Description of Software
"RealPlayer\xae SP lets you download video from thousands of Websites \x96 free! Just click on the "download this video" button above the video you want. It's just that easy. Now you can watch your favorite videos anywhere, anytime."
Product Link: http://www.real.com/realplayer/
====================================================================== 4) Description of Vulnerability
Secunia Research has discovered a vulnerability in RealPlayer, which can be exploited by malicious people to potentially compromise a user's system.
====================================================================== 6) Time Table
24/02/2010 - Vendor notified. 25/02/2010 - Vendor response. 11/03/2010 - Vendor provides status update. 19/10/2010 - Vendor provides status update. 29/11/2010 - Vendor provides status update. 10/12/2010 - Public disclosure.
====================================================================== 8) References
The Common Vulnerabilities and Exposures (CVE) project has assigned CVE-2010-0121 for the vulnerability.
====================================================================== 9) About Secunia
Secunia offers vulnerability management solutions to corporate customers with verified and reliable vulnerability intelligence relevant to their specific system configuration:
http://secunia.com/advisories/business_solutions/
Secunia also provides a publicly accessible and comprehensive advisory database as a service to the security community and private individuals, who are interested in or concerned about IT-security.
http://secunia.com/advisories/
Secunia believes that it is important to support the community and to do active vulnerability research in order to aid improving the security and reliability of software in general:
http://secunia.com/secunia_research/
Secunia regularly hires new skilled team members. Check the URL below to see currently vacant positions:
http://secunia.com/corporate/jobs/
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/advisories/mailing_lists/
====================================================================== 10) Verification
Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2010-9/
Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/
======================================================================
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201012-0017",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.0.0"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.0.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.1.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.0.3"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "11.1"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.0.5"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.6,
"vendor": "realnetworks",
"version": "1.0.2"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "12.0.0.1444"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.1.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.1.4"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "11.0"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "11.0.2.1744"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "11.0.1"
},
{
"model": "realplayer",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "11.0.2"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.1.3"
},
{
"model": "realplayer sp",
"scope": "eq",
"trust": 1.0,
"vendor": "realnetworks",
"version": "1.1.5"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0 to 11.1 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "11.0.2.1744 (linux)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "12.0.0.1444 (mac)"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0 to 1.0.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.0.2 to 1.1.1"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.1.2 to 1.1.4"
},
{
"model": "realnetworks realplayer",
"scope": "eq",
"trust": 0.8,
"vendor": "real",
"version": "sp 1.1.5"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1.5"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1.4"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0.5"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0.2"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0.1"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.0"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1.3"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1.2"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1.1"
},
{
"model": "networks realplayer sp",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1.1"
},
{
"model": "networks realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "12.0.0.1444"
},
{
"model": "networks realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.1"
},
{
"model": "networks realplayer for mac",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.2.1744"
},
{
"model": "networks realplayer beta",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "116.0.14.550"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.331"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.503"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.481"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.412"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.396"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.352"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.325"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.0.305"
},
{
"model": "networks realplayer for mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "10"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.1.3114"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.9"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.8"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.7"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.6"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.5"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.4"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.3"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.2"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "1010.0.1"
},
{
"model": "networks realplayer for linux",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "10"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.5"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.4"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.3"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.2"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.0.1"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11.1"
},
{
"model": "networks realplayer beta",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11"
},
{
"model": "networks realplayer",
"scope": "eq",
"trust": 0.3,
"vendor": "real",
"version": "11"
},
{
"model": "networks realplayer for mac",
"scope": "ne",
"trust": 0.3,
"vendor": "real",
"version": "12.0.0.1548"
},
{
"model": "networks realplayer for linux",
"scope": "ne",
"trust": 0.3,
"vendor": "real",
"version": "11.0.2.2315"
},
{
"model": "networks realplayer",
"scope": "ne",
"trust": 0.3,
"vendor": "real",
"version": "14.0.1"
}
],
"sources": [
{
"db": "BID",
"id": "45422"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002590"
},
{
"db": "NVD",
"id": "CVE-2010-0121"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-167"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:12.0.0.1444:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:realnetworks:realplayer:11.0.2.1744:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2010-0121"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Alin Rad Pop of Secunia Research",
"sources": [
{
"db": "BID",
"id": "45422"
}
],
"trust": 0.3
},
"cve": "CVE-2010-0121",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": true,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2010-0121",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-42726",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2010-0121",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201012-167",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-42726",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-42726"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002590"
},
{
"db": "NVD",
"id": "CVE-2010-0121"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-167"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The cook codec in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.5, Mac RealPlayer 11.0 through 12.0.0.1444, and Linux RealPlayer 11.0.2.1744 does not properly perform initialization, which has unspecified impact and attack vectors. Real Networks RealPlayer is prone to a memory corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. \nNOTE: This issue was previously discussed in BID 45327 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it. RealPlayer is a software package released and maintained by Real Networks, which can be used to play multimedia files encoded in Real Media format. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nRequest a free trial: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nRealPlayer Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA38550\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/38550/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nRELEASE DATE:\n2010-12-12\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/38550/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/38550/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in RealPlayer, which can\nbe exploited by malicious people to compromise a user\u0027s system. \n\n1) An error exists when parsing RealAudio content encoded using the\n\"cook\" codec. This can be exploited to trigger the use of\nuninitialised memory and potentially cause a memory corruption via\ne.g. a specially crafted RealMedia file. \n\n2) An error in the handling of errors encountered while decoding\n\"cook\"-encoded audio content can be exploited to trigger the use of\nuninitialised memory and potentially free an arbitrary address. \n\n3) An error in the parsing of AAC audio content can be exploited to\ncorrupt memory via specially crafted spectral data. \n\n4) An array indexing error when parsing Media Properties Header\n(MDPR) in a RealMedia file can be exploited to corrupt memory. \n\n5) An input validation error when parsing a RealMedia file can be\nexploited to cause a buffer overflow via a specially crafted\nmulti-rate audio stream. \n\n6) An error in the processing of the \"StreamTitle\" tag in a SHOUTcast\nstream using the ICY protocol can be exploited to cause an allocation\nfailure for heap memory, which can result in the usage of freed\npointers. \n\n7) An integer overflow error when parsing a MLLT atom in an .AAC file\ncan be exploited to cause a buffer overflow. \n\n8) An input validation error in the \"pnen3260.dll\" module in the\nparsing of TIT2 atoms within AAC files can be exploited to corrupt\nmemory. \n\n9) An integer overflow in the parsing of GIF87a files over the\nstreaming protocol RTSP can be exploited to cause a buffer overflow\nvia a large \"Screen Width\" size in the \"Screen Descriptor\" header. \n\n10) An error in the parsing of audio codec information in a Real\nAudio media file can be exploited to to cause a heap-based buffer\noverflow via a large number of subbands. \n\n11) An input validation error in drv2.dll when decompressing RV20\nvideo streams can be exploited to corrupt heap memory. \n\n12) An unspecified error related to \"SIPR\" parsing can be exploited\nto corrupt heap memory. \n\n13) An unspecified error related to \"SOUND\" processing can be\nexploited to corrupt heap memory. \n\n14) An unspecified error related to \"AAC\" processing can be exploited\nto corrupt heap memory. \n\n15) An unspecified error related to \"RealMedia\" processing can be\nexploited to corrupt heap memory. \n\n16) An unspecified error related to \"RA5\" processing can be exploited\nto corrupt heap memory. \n\n17) An integer overflow in \"drv1.dll\" when parsing SIPR stream\nmetadata can be exploited to cause a heap-based buffer overflow, e.g. \nvia the RealPlayer ActiveX control. \n\n18) An input validation error in the processing of RealMedia files\ncan be exploited to corrupt heap memory. \n\n19) An input validation error in the RealAudio codec when processing\nRealMedia files can be exploited to corrupt heap memory. \n\n20) An error in the \"HandleAction\" method in the RealPlayer ActiveX\ncontrol allows users to download and execute scripts in the \"Local\nZone\". \n\n21) Input sanitisation errors in the \"Custsupport.html\", \"Main.html\",\nand \"Upsell.htm\" components can be exploited to inject arbitrary code\ninto the RealOneActiveXObject process and load unsafe controls. \n\n22) A boundary error in the parsing of cook-specific data used for\ninitialization can be exploited to cause a heap-based buffer\noverflow. \n\n23) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to cause a heap-based\nbuffer overflow via an invalid size for an embedded MDPR chunk. \n\n24) An error in the parsing of MLTI chunks when processing Internet\nVideo Recording (.ivr) files can be exploited to corrupt heap memory\nvia an invalid number streams within the chunk. \n\n25) An input validation error when parsing the RMX file format can be\nexploited to cause a heap-based buffer overflow. \n\n26) An error when decoding data for particular mime types within a\nRealMedia file can be exploited to cause a heap-based buffer\noverflow. \n\n27) An error in the parsing of server headers can be exploited to\ncause a heap-based buffer overflow via an image tag pointing to a\nmalicious server, which causes the player to fetch a remote file. \n\n28) An error in the implementation of the Advanced Audio Coding\ncompression when decoding a conditional component of a data block\nwithin an AAC frame can be exploited to corrupt memory. \n\nSuccessful exploitation of the vulnerabilities may allow execution of\narbitrary code. \n\nSOLUTION:\nUpgrade to RealPlayer 14.0.0 or later. \n\nPROVIDED AND/OR DISCOVERED BY:\n1, 2) Alin Rad Pop, Secunia Research. \n3) Carsten Eiram, Secunia Research. \n4) Anonymous and Hossein Lotfi, reported via ZDI. \n5 - 11, 20, 21) Anonymous, reported via ZDI. \n12 - 14) The vendor credits Nicolas Joly, Vupen\n15) The vendor credits Chaouki Bekrar, Vupen\n17) Aaron Portnoy, Zef Cekaj, and Logan Brown of TippingPoint DVLabs\n18, 19) Omair, reported via iDefense. \n22, 28) Damian Put, reported via ZDI. \n23, 24) Aaron Portnoy and Logan Brown of TippingPoint DVLabs and Team\nlollersk8erz. \n25) Sebastian Apelt, reported via ZDI. \n26) Sebastian Apelt and Andreas Schmidt, reported via ZDI. \n27) AbdulAziz Hariri, reported via ZDI. \n\nORIGINAL ADVISORY:\nSecunia Research:\nhttp://secunia.com/secunia_research/2010-9/\nhttp://secunia.com/secunia_research/2010-14/\nhttp://secunia.com/secunia_research/2010-15/\n\nRealNetworks:\nhttp://service.real.com/realplayer/security/12102010_player/en/\nhttp://realnetworksblog.com/?p=2216\n\nZDI:\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-268/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-266/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-270/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-273/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-269/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-271/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-272/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-274/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-275/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-276/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-277/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-278/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-279/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-281/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-280/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-282/\nhttp://www.zerodayinitiative.com/advisories/ZDI-10-267/\n\nTippingPoint DVLabs:\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html\nhttp://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html\n\niDefense Labs:\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. \n\n====================================================================== \n2) Severity \n\nRating: Highly critical\nImpact: System access\nWhere: From remote\n\n====================================================================== \n3) Vendor\u0027s Description of Software \n\n\"RealPlayer\\xae SP lets you download video from thousands of Websites \n\\x96 free! Just click on the \"download this video\" button above the video \nyou want. It\u0027s just that easy. Now you can watch your favorite videos \nanywhere, anytime.\"\n\nProduct Link:\nhttp://www.real.com/realplayer/\n\n====================================================================== \n4) Description of Vulnerability\n\nSecunia Research has discovered a vulnerability in RealPlayer, which\ncan be exploited by malicious people to potentially compromise a \nuser\u0027s system. \n\n====================================================================== \n6) Time Table \n\n24/02/2010 - Vendor notified. \n25/02/2010 - Vendor response. \n11/03/2010 - Vendor provides status update. \n19/10/2010 - Vendor provides status update. \n29/11/2010 - Vendor provides status update. \n10/12/2010 - Public disclosure. \n\n====================================================================== \n8) References\n\nThe Common Vulnerabilities and Exposures (CVE) project has assigned\nCVE-2010-0121 for the vulnerability. \n\n====================================================================== \n9) About Secunia\n\nSecunia offers vulnerability management solutions to corporate\ncustomers with verified and reliable vulnerability intelligence\nrelevant to their specific system configuration:\n\nhttp://secunia.com/advisories/business_solutions/\n\nSecunia also provides a publicly accessible and comprehensive advisory\ndatabase as a service to the security community and private \nindividuals, who are interested in or concerned about IT-security. \n\nhttp://secunia.com/advisories/\n\nSecunia believes that it is important to support the community and to\ndo active vulnerability research in order to aid improving the \nsecurity and reliability of software in general:\n\nhttp://secunia.com/secunia_research/\n\nSecunia regularly hires new skilled team members. Check the URL below\nto see currently vacant positions:\n\nhttp://secunia.com/corporate/jobs/\n\nSecunia offers a FREE mailing list called Secunia Security Advisories:\n\nhttp://secunia.com/advisories/mailing_lists/\n\n====================================================================== \n10) Verification \n\nPlease verify this advisory by visiting the Secunia website:\nhttp://secunia.com/secunia_research/2010-9/\n\nComplete list of vulnerability reports published by Secunia Research:\nhttp://secunia.com/secunia_research/\n\n======================================================================\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2010-0121"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002590"
},
{
"db": "BID",
"id": "45422"
},
{
"db": "VULHUB",
"id": "VHN-42726"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96815"
},
{
"db": "PACKETSTORM",
"id": "96637"
}
],
"trust": 2.34
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-42726",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-42726"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2010-0121",
"trust": 2.9
},
{
"db": "SECUNIA",
"id": "38550",
"trust": 1.6
},
{
"db": "SECUNIA",
"id": "42565",
"trust": 1.5
},
{
"db": "SECTRACK",
"id": "1024861",
"trust": 1.1
},
{
"db": "VUPEN",
"id": "ADV-2010-3190",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002590",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201012-167",
"trust": 0.7
},
{
"db": "SECUNIA",
"id": "42512",
"trust": 0.7
},
{
"db": "BID",
"id": "45422",
"trust": 0.4
},
{
"db": "PACKETSTORM",
"id": "96815",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-42726",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-268",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-273",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-272",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-267",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-276",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-269",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-280",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-282",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-278",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-277",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-271",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-274",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-266",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-281",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-279",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-270",
"trust": 0.1
},
{
"db": "ZDI",
"id": "ZDI-10-275",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96636",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96640",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "96637",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-42726"
},
{
"db": "BID",
"id": "45422"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002590"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96815"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-0121"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-167"
}
]
},
"id": "VAR-201012-0017",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-42726"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:10:58.943000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u5bfe\u5fdc\u3059\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/ja"
},
{
"title": "Releases Update to Address Security Vulnerabilities",
"trust": 0.8,
"url": "http://service.real.com/realplayer/security/12102010_player/en"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002590"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002590"
},
{
"db": "NVD",
"id": "CVE-2010-0121"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://service.real.com/realplayer/security/12102010_player/en/"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/38550"
},
{
"trust": 1.4,
"url": "http://secunia.com/advisories/42565"
},
{
"trust": 1.1,
"url": "http://www.securitytracker.com/id?1024861"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0121"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-0121"
},
{
"trust": 0.8,
"url": "http://www.vupen.com/english/advisories/2010/3190"
},
{
"trust": 0.6,
"url": "http://secunia.com/advisories/42512"
},
{
"trust": 0.3,
"url": "http://www.real.com/"
},
{
"trust": 0.3,
"url": "http://dvlabs.tippingpoint.com/blog/2010/12/09/realnetworks-patches-27-vulnerabilities"
},
{
"trust": 0.3,
"url": "/archive/1/515362"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.3,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.3,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.3,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.3,
"url": "http://realnetworksblog.com/?p=2216"
},
{
"trust": 0.2,
"url": "http://secunia.com/secunia_research/2010-9/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-267/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-276/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-14/"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=883"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/2010-15/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-266/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-275/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0212.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-274/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-273/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-269/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-281/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-270/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0216.html"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=38550"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/38550/#comments"
},
{
"trust": 0.1,
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=884"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-277/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-272/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-278/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-279/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-271/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-268/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-282/"
},
{
"trust": 0.1,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0213.html"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-10-280/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42512/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42512"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42512/"
},
{
"trust": 0.1,
"url": "http://www.real.com/realplayer/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_research/"
},
{
"trust": 0.1,
"url": "http://secunia.com/corporate/jobs/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/mailing_lists/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/business_solutions/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-0121"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=42565"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/42565/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-42726"
},
{
"db": "BID",
"id": "45422"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002590"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96815"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-0121"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-167"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-42726"
},
{
"db": "BID",
"id": "45422"
},
{
"db": "JVNDB",
"id": "JVNDB-2010-002590"
},
{
"db": "PACKETSTORM",
"id": "96636"
},
{
"db": "PACKETSTORM",
"id": "96640"
},
{
"db": "PACKETSTORM",
"id": "96815"
},
{
"db": "PACKETSTORM",
"id": "96637"
},
{
"db": "NVD",
"id": "CVE-2010-0121"
},
{
"db": "CNNVD",
"id": "CNNVD-201012-167"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2010-12-14T00:00:00",
"db": "VULHUB",
"id": "VHN-42726"
},
{
"date": "2010-12-10T00:00:00",
"db": "BID",
"id": "45422"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002590"
},
{
"date": "2010-12-13T04:13:47",
"db": "PACKETSTORM",
"id": "96636"
},
{
"date": "2010-12-13T04:13:58",
"db": "PACKETSTORM",
"id": "96640"
},
{
"date": "2010-12-20T20:38:56",
"db": "PACKETSTORM",
"id": "96815"
},
{
"date": "2010-12-13T04:13:50",
"db": "PACKETSTORM",
"id": "96637"
},
{
"date": "2010-12-14T16:00:02.773000",
"db": "NVD",
"id": "CVE-2010-0121"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-167"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-01-19T00:00:00",
"db": "VULHUB",
"id": "VHN-42726"
},
{
"date": "2010-12-20T15:04:00",
"db": "BID",
"id": "45422"
},
{
"date": "2011-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2010-002590"
},
{
"date": "2011-01-19T05:00:00",
"db": "NVD",
"id": "CVE-2010-0121"
},
{
"date": "2010-12-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201012-167"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-167"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "RealNetworks RealPlayer of cook Vulnerability in codec",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2010-002590"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201012-167"
}
],
"trust": 0.6
}
}
FKIE_CVE-2022-32291
Vulnerability from fkie_nvd - Published: 2022-06-05 22:15 - Updated: 2024-11-21 07:06
Severity ?
Summary
In Real Player through 20.1.0.312, attackers can execute arbitrary code by placing a UNC share pathname (for a DLL file) in a RAM file.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | https://github.com/Edubr2020/RP_RecordClip_DLL_Hijack | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/Edubr2020/RP_RecordClip_DLL_Hijack | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| realnetworks | realplayer | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:realnetworks:realplayer:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7094A85F-7819-4905-A7E1-ED59DE04A993",
"versionEndIncluding": "20.1.0.312",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Real Player through 20.1.0.312, attackers can execute arbitrary code by placing a UNC share pathname (for a DLL file) in a RAM file."
},
{
"lang": "es",
"value": "En Real Player versiones hasta 20.1.0.312, los atacantes pueden ejecutar c\u00f3digo arbitrario al colocar un nombre de ruta compartido UNC (para un archivo DLL) en un archivo RAM"
}
],
"id": "CVE-2022-32291",
"lastModified": "2024-11-21T07:06:06.937",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-05T22:15:08.680",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/Edubr2020/RP_RecordClip_DLL_Hijack"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/Edubr2020/RP_RecordClip_DLL_Hijack"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2022-32269
Vulnerability from fkie_nvd - Published: 2022-06-03 06:15 - Updated: 2024-11-21 07:06
Severity ?
Summary
In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages (displayed by Internet Explorer core). This leads to arbitrary code execution.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | https://github.com/Edubr2020/RealPlayer_G2_RCE | Exploit, Third Party Advisory | |
| cve@mitre.org | https://www.youtube.com/watch?v=9c9Q4VZQOUk | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/Edubr2020/RealPlayer_G2_RCE | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.youtube.com/watch?v=9c9Q4VZQOUk | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| realnetworks | realplayer | 20.0.8.310 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:realnetworks:realplayer:20.0.8.310:*:*:*:*:*:*:*",
"matchCriteriaId": "E86C53C2-37F0-40AC-BB65-0E36850C5487",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages (displayed by Internet Explorer core). This leads to arbitrary code execution."
},
{
"lang": "es",
"value": "En Real Player versi\u00f3n 20.0.8.310, el Control G2 permite la inyecci\u00f3n de javascript no seguro: URIs en p\u00e1ginas locales de error HTTP (mostradas por el n\u00facleo de Internet Explorer). Esto conlleva a una ejecuci\u00f3n de c\u00f3digo arbitrario"
}
],
"id": "CVE-2022-32269",
"lastModified": "2024-11-21T07:06:04.033",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-03T06:15:07.643",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/Edubr2020/RealPlayer_G2_RCE"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.youtube.com/watch?v=9c9Q4VZQOUk"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/Edubr2020/RealPlayer_G2_RCE"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.youtube.com/watch?v=9c9Q4VZQOUk"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2022-32271
Vulnerability from fkie_nvd - Published: 2022-06-03 06:15 - Updated: 2024-11-21 07:06
Severity ?
Summary
In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Real Player to reference a file that contains an URL. It is possible to inject script code to arbitrary domains. It is also possible to reference arbitrary local files.
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | https://github.com/Edubr2020/RP_DCP_Code_Exec | Exploit, Third Party Advisory | |
| cve@mitre.org | https://youtu.be/AMODp3iTnqY | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/Edubr2020/RP_DCP_Code_Exec | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://youtu.be/AMODp3iTnqY | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| realnetworks | realplayer | 20.0.8.310 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:realnetworks:realplayer:20.0.8.310:*:*:*:*:*:*:*",
"matchCriteriaId": "E86C53C2-37F0-40AC-BB65-0E36850C5487",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Real Player to reference a file that contains an URL. It is possible to inject script code to arbitrary domains. It is also possible to reference arbitrary local files."
},
{
"lang": "es",
"value": "En Real Player versi\u00f3n 20.0.8.310, Se presenta una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo arbitraria remota DCP:// URI. Esto es un protocolo de URL interno usado por Real Player para hacer referencia a un archivo que contiene una URL. Es posible inyectar c\u00f3digo de script a dominios arbitrarios. Tambi\u00e9n es posible referenciar archivos locales arbitrarios"
}
],
"id": "CVE-2022-32271",
"lastModified": "2024-11-21T07:06:04.347",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 6.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-03T06:15:07.753",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/Edubr2020/RP_DCP_Code_Exec"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://youtu.be/AMODp3iTnqY"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/Edubr2020/RP_DCP_Code_Exec"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://youtu.be/AMODp3iTnqY"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2022-32270
Vulnerability from fkie_nvd - Published: 2022-06-03 06:15 - Updated: 2024-11-21 07:06
Severity ?
Summary
In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder (DLL planting could also occur).
References
| URL | Tags | ||
|---|---|---|---|
| cve@mitre.org | https://github.com/Edubr2020/RP_Import_RCE | Exploit, Third Party Advisory | |
| cve@mitre.org | https://youtu.be/CONlijEgDLc | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/Edubr2020/RP_Import_RCE | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://youtu.be/CONlijEgDLc | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| realnetworks | realplayer | 20.0.7.309 | |
| realnetworks | realplayer | 20.0.8.310 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:realnetworks:realplayer:20.0.7.309:*:*:*:*:*:*:*",
"matchCriteriaId": "B9AC83C3-55F0-498F-A2B5-480012F73A6B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:realnetworks:realplayer:20.0.8.310:*:*:*:*:*:*:*",
"matchCriteriaId": "E86C53C2-37F0-40AC-BB65-0E36850C5487",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder (DLL planting could also occur)."
},
{
"lang": "es",
"value": "En Real Player versiones 20.0.7.309 y 20.0.8.310, la funci\u00f3n external::Import() permite la descarga de tipos de archivos arbitrarios y un Salto de Directorio, conllevando a una Ejecuci\u00f3n de C\u00f3digo Remota. Esto ocurre porque es posible plantar ejecutables en la carpeta de inicio (tambi\u00e9n podr\u00eda ocurrir la plantaci\u00f3n de DLL)"
}
],
"id": "CVE-2022-32270",
"lastModified": "2024-11-21T07:06:04.183",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-03T06:15:07.697",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/Edubr2020/RP_Import_RCE"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://youtu.be/CONlijEgDLc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/Edubr2020/RP_Import_RCE"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://youtu.be/CONlijEgDLc"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2022-32291 (GCVE-0-2022-32291)
Vulnerability from cvelistv5 – Published: 2022-06-05 21:23 – Updated: 2024-08-03 07:39
VLAI?
Summary
In Real Player through 20.1.0.312, attackers can execute arbitrary code by placing a UNC share pathname (for a DLL file) in a RAM file.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:39:50.541Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Edubr2020/RP_RecordClip_DLL_Hijack"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Real Player through 20.1.0.312, attackers can execute arbitrary code by placing a UNC share pathname (for a DLL file) in a RAM file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-05T21:23:45",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Edubr2020/RP_RecordClip_DLL_Hijack"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-32291",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Real Player through 20.1.0.312, attackers can execute arbitrary code by placing a UNC share pathname (for a DLL file) in a RAM file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Edubr2020/RP_RecordClip_DLL_Hijack",
"refsource": "MISC",
"url": "https://github.com/Edubr2020/RP_RecordClip_DLL_Hijack"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-32291",
"datePublished": "2022-06-05T21:23:45",
"dateReserved": "2022-06-05T00:00:00",
"dateUpdated": "2024-08-03T07:39:50.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-32270 (GCVE-0-2022-32270)
Vulnerability from cvelistv5 – Published: 2022-06-03 05:35 – Updated: 2024-08-03 07:39
VLAI?
Summary
In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder (DLL planting could also occur).
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:39:50.355Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Edubr2020/RP_Import_RCE"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://youtu.be/CONlijEgDLc"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder (DLL planting could also occur)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-03T05:35:35",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Edubr2020/RP_Import_RCE"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://youtu.be/CONlijEgDLc"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-32270",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Traversal, leading to Remote Code Execution. This occurs because it is possible to plant executables in the startup folder (DLL planting could also occur)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Edubr2020/RP_Import_RCE",
"refsource": "MISC",
"url": "https://github.com/Edubr2020/RP_Import_RCE"
},
{
"name": "https://youtu.be/CONlijEgDLc",
"refsource": "MISC",
"url": "https://youtu.be/CONlijEgDLc"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-32270",
"datePublished": "2022-06-03T05:35:35",
"dateReserved": "2022-06-03T00:00:00",
"dateUpdated": "2024-08-03T07:39:50.355Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-32291 (GCVE-0-2022-32291)
Vulnerability from nvd – Published: 2022-06-05 21:23 – Updated: 2024-08-03 07:39
VLAI?
Summary
In Real Player through 20.1.0.312, attackers can execute arbitrary code by placing a UNC share pathname (for a DLL file) in a RAM file.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:39:50.541Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Edubr2020/RP_RecordClip_DLL_Hijack"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Real Player through 20.1.0.312, attackers can execute arbitrary code by placing a UNC share pathname (for a DLL file) in a RAM file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-05T21:23:45",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Edubr2020/RP_RecordClip_DLL_Hijack"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-32291",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Real Player through 20.1.0.312, attackers can execute arbitrary code by placing a UNC share pathname (for a DLL file) in a RAM file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Edubr2020/RP_RecordClip_DLL_Hijack",
"refsource": "MISC",
"url": "https://github.com/Edubr2020/RP_RecordClip_DLL_Hijack"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-32291",
"datePublished": "2022-06-05T21:23:45",
"dateReserved": "2022-06-05T00:00:00",
"dateUpdated": "2024-08-03T07:39:50.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}