Secunia

Several vulnerabilities have been reported in RealOne Player, RealPlayer, Helix Player and Rhapsody, which can be exploited by malicious people to overwrite local files or to compromise a user's system.

1) An unspecified error can be exploited to overwrite local files or to execute an ActiveX control on a user's system via a specially crafted MP3 file.

2) A boundary error in the "CRealTextFileFormat::ReadDone()" function when processing RealText streams can be exploited to cause a heap-based buffer overflow via a specially crafted RealMedia file.

Successful exploitation allows execution of arbitrary code.

3) A boundary error in the processing of AVI movie files can be exploited to cause a heap-based buffer overflow via a specially crafted AVI movie file.

Successful exploitation allows execution of arbitrary code.

4) An unspecified error can be exploited by a malicious web site to create a local HTML file on the user's system and then trigger a RM file that references this local HTML file.

Successful exploitation requires that a user opens a malicious MP3, RealMedia or AVI file, or visits a malicious web site that causes the user's browser to automatically load the malicious file.

The following products are affected by some or all of the vulnerabilities:
* RealPlayer 10.5 (6.0.12.1040-1069)
* RealPlayer 10
* RealOne Player v2
* RealOne Player v1
* RealPlayer 8
* RealPlayer Enterprise
* Mac RealPlayer 10 (10.0.0.305 - 331)
* Mac RealOne Player
* Linux RealPlayer 10 (10.0.0 - 4)
* Helix Player (10.0.0 - 4)
* Rhapsody 3 (build 0.815 - 0.1006)

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
1) John Heasman of NGSSoftware.
2) Discovered by anonymous person and reported via iDEFENSE.
3) Flashsky, eEye Digital Security.

Changelog
Further details available in Customer Area

Original Advisory
RealNetworks:
http://service.real.com/help/faq/security/050623_player/EN/
http://www.service.real.com/help/faq/security/security062305.html

iDEFENSE:
http://www.idefense.com/application/poi/display?id=250&type=vulnerabilities

eEye Digital Security:
http://www.eeye.com/html/research/advisories/AD20050623.html

Deep Links
Links available in Customer Area