PT-2010-4472 · Realnetworks · Linux Realplayer+3

Publicado 2010-12-10 · Atualizado 2011-01-19 · CVE-2010-2999

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RealPlayer versions 11.0 through 11.1 RealPlayer SP versions 1.0 through 1.0.1 Mac RealPlayer versions 11.0 through 11.1 Linux RealPlayer version 11.0.2.1744

Description The issue allows remote attackers to execute arbitrary code or cause a denial of service due to heap memory corruption via a malformed MLLT atom in an AAC file.

Recommendations For RealPlayer versions 11.0 through 11.1, consider disabling the parsing of MLLT atoms in AAC files until a patch is available. For RealPlayer SP versions 1.0 through 1.0.1, restrict access to AAC files to minimize the risk of exploitation. For Mac RealPlayer versions 11.0 through 11.1, avoid using the affected AAC parsing functionality until the issue is resolved. For Linux RealPlayer version 11.0.2.1744, as a temporary workaround, consider disabling the playback of AAC files until a patch is available.

Correção

RCE

DoS

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2010-2999

ZDI-10-273

Produtos afetados

Linux Realplayer

Mac Realplayer

Realplayer

Realplayer Sp

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2010-2999 · Nota de Segurança
• http://service.real.com/realplayer/security/12102010_player/en · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-10-273 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-10-273 · Nota
• http://securitytracker.com/id?1024861 · Nota