PT-2011-3121 · Realnetworks · Realplayer Sp+1

Andrea Micalizzi + 2 · Publicado 2011-04-12 · Atualizado 2018-10-09 · CVE-2011-1426

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RealPlayer versions 11.0 through 11.1 RealPlayer versions 14.0.0 through 14.0.2 RealPlayer SP versions 1.0 through 1.1.5

Description The issue allows remote attackers to execute arbitrary code via a .rnx filename corresponding to a crafted RNX file. This is due to the OpenURLInDefaultBrowser method launching a default handler for the filename specified in the first argument.

Recommendations For RealPlayer versions 11.0 through 11.1, consider disabling the OpenURLInDefaultBrowser method until a patch is available. For RealPlayer versions 14.0.0 through 14.0.2, restrict access to the OpenURLInDefaultBrowser method to minimize the risk of exploitation. For RealPlayer SP versions 1.0 through 1.1.5, avoid using the OpenURLInDefaultBrowser method with untrusted filenames until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2011-1426

ZDI-11-122

Produtos afetados

Realplayer

Realplayer Sp

Referências · 10

• https://nvd.nist.gov/vuln/detail/CVE-2011-1426 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-11-122 · Nota
• http://vupen.com/english/advisories/2011/0979 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-11-122 · Nota de Segurança
• http://securityfocus.com/archive/1/517470/100/0/threaded · Nota
• http://service.real.com/realplayer/security/04122011_player/en · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66728 · Nota
• http://securitytracker.com/id?1025351 · Nota
• http://xforce.iss.net/xforce/xfdb/66728 · Nota
• http://securityfocus.com/bid/47335 · Nota