RealPlayer Heap Overflow in Processing SWF File Frames Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1020562 |
|
SecurityTracker URL: http://securitytracker.com/id/1020562
|
|
CVE Reference:
CVE-2007-5400
(Links to External Site)
|
Updated: Jul 25 2008
|
Original Entry Date: Jul 25 2008
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 10; 10.5 (6.0.12.1040-6.0.12.1663, 6.0.12.1698, 6.0.12.1741); 11.0.0 - 11.0.2 builds 6.0.14.738 - 6.0.14.802; 10 (10.0.0.305 - 352) for Mac; 10.1 (10.0.0.396 - 10.0.0.503) for Mac; 10 for Linux
|
Description:
A vulnerability was reported in RealPlayer. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a Shockwave Flash (SWF) file containing specially crafted frames that, when loaded by the target user, will trigger a heap overflow and execute arbitrary code on the target system. The code will run with the privileges of the target user.
The vendor was notified on November 16, 2007.
Real Player Enterprise is also affected.
Rhapsody 4 is not afffected.
Dyon Balding of Secunia Research reported this vulnerability.
|
Impact:
A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution:
The vendor has issued a fix (10.5 (6.0.12.1675) for Windows; 11.0.3 build 6.0.14.806 for Windows; 11 for Mac; 11 for Linux).
The vendor's advisory is available at:
http://www.service.real.com/realplayer/security/07252008_player/en/
|
Vendor URL: www.service.real.com/realplayer/security/07252008_player/en/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS: Linux (Any), UNIX (macOS/OS X), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Subject: Secunia Research: RealPlayer SWF Frame Handling Buffer Overflow
|
======================================================================
Secunia Research 25/07/2008
- RealNetworks RealPlayer SWF Frame Handling Buffer Overflow -
======================================================================
Table of Contents
Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10
======================================================================
1) Affected Software
RealNetworks RealPlayer Version 10.5 Build 6.0.12.1483
NOTE: Other versions may also be affected.
======================================================================
2) Severity
Rating: Highly critical
Impact: System access
Where: From remote
======================================================================
3) Vendor's Description of Software
"Download Web video instantly".
Product Link:
http://www.real.com/player
======================================================================
4) Description of Vulnerability
Secunia Research has discovered a vulnerability in RealPlayer, which
can potentially be exploited by malicious people to compromise a
user's system.
The vulnerability is caused due to a design error within the handling
of frames in Shockwave Flash (SWF) files and can be exploited to cause
a heap-based buffer overflow.
Successful exploitation may allow execution of arbitrary code.
======================================================================
5) Solution
The vulnerability is fixed in an upcoming release.
======================================================================
6) Time Table
16/11/2007 - Vendor notified.
22/11/2007 - Vendor notified again.
26/11/2007 - Vendor response and request PoC.
29/11/2007 - Sent PoC to vendor.
03/01/2008 - Confirmation that vendor able to reproduce vulnerability.
27/05/2008 - Requested update from vendor.
07/07/2008 - Vendor confirms update is pending.
23/07/2008 - Vendor confirms disclosure date.
25/07/2008 - Public disclosure.
======================================================================
7) Credits
Discovered by Dyon Balding, Secunia Research.
======================================================================
8) References
The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2007-5400 for the vulnerability.
======================================================================
9) About Secunia
Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:
http://corporate.secunia.com/
Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.
http://secunia.com/
Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:
http://corporate.secunia.com/secunia_research/33/
Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:
http://secunia.com/secunia_vacancies/
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/secunia_security_advisories/
======================================================================
10) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2007-93/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================
|
|
