PT-2010-5461 · Realnetworks+1 · Realplayer Enterprise+5

Hossein Lotfi · Publicado 2010-12-10 · Atualizado 2011-01-26 · CVE-2010-4384

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RealPlayer versions 11.0 through 11.1 RealPlayer Enterprise version 2.1.2 Mac RealPlayer versions 11.0 through 11.1 Linux RealPlayer version 11.0.2.1744 HelixPlayer version 1.0.6

Description The issue is related to an array index error in the Media Properties Header parsing functionality. This error allows remote attackers to execute arbitrary code via a malformed Media Properties Header in a RealMedia file. No information is provided about the estimated number of potentially affected devices or real-world incidents.

Recommendations For RealPlayer versions 11.0 through 11.1, update to a version that fixes the Media Properties Header parsing issue. For RealPlayer Enterprise version 2.1.2, update to a version that fixes the Media Properties Header parsing issue. For Mac RealPlayer versions 11.0 through 11.1, update to a version that fixes the Media Properties Header parsing issue. For Linux RealPlayer version 11.0.2.1744, update to a version that fixes the Media Properties Header parsing issue. For HelixPlayer version 1.0.6, update to a version that fixes the Media Properties Header parsing issue. As a temporary workaround, consider avoiding the use of RealMedia files from untrusted sources until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2010-4384

RHSA-2010:0981

RHSA-2010_0981

ZDI-10-268

Produtos afetados

Helix Player

Linux Realplayer

Mac Realplayer

Realplayer

Realplayer Enterprise

Red Hat

Referências · 17

• https://access.redhat.com/security/cve/CVE-2010-4378 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4384 · Nota
• http://redhat.com/support/errata/RHSA-2010-0981.html · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-10-268 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2010-4383 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4385 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4375 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4382 · Nota
• https://access.redhat.com/errata/RHSA-2010:0981 · Nota
• https://access.redhat.com/security/cve/CVE-2010-2997 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4392 · Nota
• http://service.real.com/realplayer/security/12102010_player/en · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-4379 · Nota
• https://access.redhat.com/security/cve/CVE-2010-4386 · Nota
• http://zerodayinitiative.com/advisories/ZDI-10-268 · Nota