PT-2002-2021 · Microsoft+1 · Internet Explorer+2

Published 2002-10-04 · Updated 2008-09-05 · CVE-2002-1015

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: RealJukebox 2 versions 1.0.2.340 through 1.0.2.379 RealOne Player Gold version 6.0.10.505

Description: The issue allows remote attackers to execute arbitrary script in the Local computer zone. This is achieved by inserting the script into the skin.ini file of an RJS archive, then referencing skin.ini from a web page after it has been extracted. The extracted file is parsed as HTML by Internet Explorer or other Microsoft-based web readers.

Recommendations: For RealJukebox 2 versions 1.0.2.340 through 1.0.2.379, consider disabling the execution of scripts from RJS archives until a patch is available. For RealOne Player Gold version 6.0.10.505, restrict access to the skin.ini file to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-1015

Affected Products

Internet Explorer

Realjukebox 2

Realone Player Gold

References · 6

• http://iss.net/security_center/static/9539.php · Vendor Advisory
• http://securityfocus.com/bid/5210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1015 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2002-07/0130.html · Note
• http://kb.cert.org/vuls/id/888547 · Note
• http://service.real.com/help/faq/security/bufferoverrun07092002.html · Note