PT-2010-4469 · Realnetworks · Realplayer

Publicado 2010-08-26 · Atualizado 2018-10-10 · CVE-2010-2996

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RealPlayer versions 11.0 through 11.1

Description The issue is related to an array index error that allows remote attackers to execute arbitrary code via a malformed header in a RealMedia .IVR file. This is a code execution issue.

Recommendations For versions 11.0 through 11.1, update to a version that contains a fix for this issue to prevent arbitrary code execution.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-2996

ZDI-10-166

Produtos afetados

Realplayer

Referências · 12

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6703 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61425 · Nota
• http://service.real.com/realplayer/security/08262010_player/en · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2996 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-10-166 · Nota
• http://service.real.com/realplayer/security/10152010_player/en · Nota
• http://vupen.com/english/advisories/2010/2216 · Nota
• http://secunia.com/advisories/41154 · Nota
• https://zerodayinitiative.com/advisories/ZDI-10-166 · Nota de Segurança
• http://securitytracker.com/id?1024370 · Nota
• http://securityfocus.com/archive/1/513381/100/0/threaded · Nota
• http://xforce.iss.net/xforce/xfdb/61425 · Nota