PT-2004-3654 · Realnetworks · Realplayer

John Heasman · Publicado 2004-10-06 · Atualizado 2017-11-16 · CVE-2005-0189

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RealPlayer versions prior to 10.5 (6.0.12.1040)

Description The issue is related to a stack-based buffer overflow in the HandleAction function. This allows remote attackers to execute arbitrary code via a long ShowPreferences argument.

Recommendations For versions prior to 10.5 (6.0.12.1040), consider updating to a version that is not affected by this issue. As a temporary workaround, restrict the use of the HandleAction function until a patch is available. Avoid using long ShowPreferences arguments in the affected API endpoint until the issue is resolved.

Correção

Identificadores relacionados

CVE-2005-0189

Produtos afetados

Realplayer

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2005-0189 · Nota de Segurança
• http://securityfocus.com/bid/12311 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=109707741022291&w=2 · Nota
• http://marc.info/?l=bugtraq&m=110616636318261&w=2 · Nota
• http://archives.neohapsis.com/archives/ntbugtraq/2005-q1/0046.html · Aviso do Fabricante
• http://kb.cert.org/vuls/id/698390 · Correção
• http://service.real.com/help/faq/security/040928_player/EN · Aviso do Fabricante