RealNetworks Products Multiple Buffer Overflow Vulnerabilities - Secunia Advisories - Vulnerability Intelligence

RealNetworks Products Multiple Buffer Overflow Vulnerabilities
Secunia Advisory:	SA19358	Advisory Toolbox: Issue ticket Save in to-do list Mark as handled Exploit information Download as PDF Review actions Add comment
Release Date:	2006-03-23
Last Update:	2006-04-12
Popularity:	20,433 views

Critical:	Highly critical
Impact:	System access
Where:	From remote
Solution Status:	Vendor Patch

Software:	Helix Player 1.x RealOne Player 1.x RealOne Player 2.x RealPlayer 10.x RealPlayer 8 RealPlayer Enterprise 1.x Rhapsody 3

Subscribe:	Instant alerts on relevant vulnerabilities

CVE reference:	CVE-2005-2922 CVE-2005-2936 CVE-2006-0323 CVE-2006-1370

Description: Some vulnerabilities have been reported in various RealNetworks products, which can be exploited by malicious people to compromise a user's system. 1) A boundary error within the handling of the "chunked" Transfer-Encoding method can be exploited via a specially crafted web page on a malicious server to cause a heap-based buffer overflow. This allows execution of arbitrary code on the user's system. 2) Boundary errors in swfformat.dll when processing SWF files can be exploited to cause buffer overflows when the specified size is smaller than the actual size. Successful exploitation may allow execution of arbitrary code on a user's system. 3) A boundary error in the processing of MBC files can be exploited to cause a buffer overflow. This may allow execution of arbitrary code on the user's system. A weakness when executing other programs is caused due to incorrect use of the "CreateProcess()" API. This may allow execution of an arbitrary program on the system, if this can be placed in the program path. The following products are affected by one of more of the vulnerabilities: * RealPlayer 10.5 (6.0.12.1040-1348) * RealPlayer 10 * RealOne Player v2 * RealOne Player v1 * RealPlayer 8 * RealPlayer Enterprise * Rhapsody 3 (build 0.815 – 1.0.269) * Mac RealPlayer 10 (10.0.0.305 - 331) * Mac RealOne Player * Linux RealPlayer 10 (10.0.6) * Helix Player (10.0.6) * Linux RealPlayer 10 (10.0.0 - 5) * Helix Player (10.0.0 - 5) Solution: See patch matrix in vendor advisory for details. Provided and/or discovered by: 1) Greg MacManus, iDEFENSE Labs. 2) Sowhat The vendor also credits John Heasman, NGS Software. Changelog: 2006-03-24: Added additional information from iDEFENSE. 2006-03-27: Added CVE reference. 2006-04-03: Added links to US-CERT vulnerability notes. 2006-04-06: Added link to US-CERT vulnerability note. 2006-04-12: Added additional information from Sowhat. Original Advisory: RealNetworks: http://service.real.com/realplayer/security/03162006_player/en/ http://service.real.com/realplayer/security/security/enterprise_031606.html http://service.real.com/help/faq/security/security111605.html iDEFENSE: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=340 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=404 Sowhat: http://secway.org/advisory/AD20060322.txt Other References: US-CERT VU#172489: http://www.kb.cert.org/vuls/id/172489 US-CERT VU#231028: http://www.kb.cert.org/vuls/id/231028 US-CERT VU#451556: http://www.kb.cert.org/vuls/id/451556

Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released. Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

Latest Advisories

15th Oct, 2008

New advisories:	16
New vulnerabilities:	60
Updated advisories:	36

Moderately // 354 views

WordPress WP Comment Remix Plugin Multiple Vulnerabilities

Less // 312 views

Elxis mod_language.php Cross-Site Scripting Vulnerability

Moderately // 329 views

MyPHPDating "id" SQL Injection Vulnerability

Moderately // 401 views

BEA WebLogic Server Multiple Authorizers Security Bypass

Moderately // 360 views

BEA WebLogic Workshop NetUI Pageflow Information Disclosure Vulnerability

Moderately // 332 views

BEA WebLogic Workshop NetUI Tags Information Disclosure Vulnerability

Highly // 474 views

BEA WebLogic Server Multiple Vulnerabilities

Moderately // 540 views

Oracle Products Multiple Vulnerabilities

Moderately // 397 views

Webscene eCommerce "level" SQL Injection Vulnerability

Moderately // 563 views

Sun Solaris "sadmind" Buffer Overflow Vulnerability

Solutions | More...

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.