PT-2002-2020 · Real · Realjukebox 2+1

Publicado 2002-10-04 · Atualizado 2008-09-05 · CVE-2002-1014

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: RealJukebox 2 version 1.0.2.340 RealJukebox 2 version 1.0.2.379 RealOne Player Gold version 6.0.10.505

Description: The issue allows remote attackers to execute arbitrary code via an RFS skin file. This is achieved by including a long value in a CONTROLnImage argument, such as CONTROL1Image, within the skin.ini file of the RFS skin file.

Recommendations: For RealJukebox 2 version 1.0.2.340, consider disabling the processing of RFS skin files until a patch is available. For RealJukebox 2 version 1.0.2.379, restrict access to RFS skin files to minimize the risk of exploitation. For RealOne Player Gold version 6.0.10.505, avoid using the CONTROLnImage argument in the skin.ini file of RFS skin files until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2002-1014

Produtos afetados

Realjukebox 2

Realone Player Gold

Referências · 7

• 🔥 https://exploit-db.com/exploits/21615 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1014 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2002-07/0127.html · Nota
• http://iss.net/security_center/static/9538.php · Aviso do Fabricante
• http://kb.cert.org/vuls/id/843667 · Nota
• http://securityfocus.com/bid/5217 · Aviso do Fabricante
• http://service.real.com/help/faq/security/bufferoverrun07092002.html · Nota