PT-2002-2021 · Microsoft+1 · Internet Explorer+2

Publicado 2002-10-04 · Atualizado 2008-09-05 · CVE-2002-1015

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: RealJukebox 2 versions 1.0.2.340 through 1.0.2.379 RealOne Player Gold version 6.0.10.505

Description: The issue allows remote attackers to execute arbitrary script in the Local computer zone. This is achieved by inserting the script into the skin.ini file of an RJS archive, then referencing skin.ini from a web page after it has been extracted. The extracted file is parsed as HTML by Internet Explorer or other Microsoft-based web readers.

Recommendations: For RealJukebox 2 versions 1.0.2.340 through 1.0.2.379, consider disabling the execution of scripts from RJS archives until a patch is available. For RealOne Player Gold version 6.0.10.505, restrict access to the skin.ini file to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2002-1015

Produtos afetados

Internet Explorer

Realjukebox 2

Realone Player Gold

Referências · 6

• http://iss.net/security_center/static/9539.php · Aviso do Fabricante
• http://securityfocus.com/bid/5210 · Aviso do Fabricante
• http://archives.neohapsis.com/archives/bugtraq/2002-07/0130.html · Nota
• http://kb.cert.org/vuls/id/888547 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1015 · Nota de Segurança
• http://service.real.com/help/faq/security/bufferoverrun07092002.html · Nota