PT-2002-2020 · Real · Realjukebox 2+1

Published 2002-10-04 · Updated 2008-09-05 · CVE-2002-1014

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: RealJukebox 2 version 1.0.2.340 RealJukebox 2 version 1.0.2.379 RealOne Player Gold version 6.0.10.505

Description: The issue allows remote attackers to execute arbitrary code via an RFS skin file. This is achieved by including a long value in a CONTROLnImage argument, such as CONTROL1Image, within the skin.ini file of the RFS skin file.

Recommendations: For RealJukebox 2 version 1.0.2.340, consider disabling the processing of RFS skin files until a patch is available. For RealJukebox 2 version 1.0.2.379, restrict access to RFS skin files to minimize the risk of exploitation. For RealOne Player Gold version 6.0.10.505, avoid using the CONTROLnImage argument in the skin.ini file of RFS skin files until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2002-1014

Affected Products

Realjukebox 2

Realone Player Gold

References · 7

• 🔥 https://exploit-db.com/exploits/21615 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1014 · Security Note
• http://iss.net/security_center/static/9538.php · Vendor Advisory
• http://securityfocus.com/bid/5217 · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2002-07/0127.html · Note
• http://kb.cert.org/vuls/id/843667 · Note
• http://service.real.com/help/faq/security/bufferoverrun07092002.html · Note