PT-2004-1537 · Realnetworks · Realplayer+2

Published 2004-04-16 · Updated 2017-07-11 · CVE-2004-0387

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RealPlayer version 8 RealOne Player (affected versions not specified) RealOne Player 10 beta RealOne Player Enterprise (affected versions not specified)

Description The issue is a stack-based buffer overflow in the RT3 plugin. This allows remote attackers to execute arbitrary code via a malformed .R3T file.

Recommendations For RealPlayer version 8, update to a version that does not use the vulnerable RT3 plugin. For RealOne Player, RealOne Player 10 beta, and RealOne Player Enterprise, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2004-0387

Affected Products

Rt3 Plugin

Realone Player

Realplayer

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2004-0387 · Security Note
• http://ngssoftware.com/advisories/realr3t.txt · Vendor Advisory
• http://service.real.com/help/faq/security/040406_r3t/en · Vendor Advisory
• http://osvdb.org/displayvuln.php?osvdb_id=4977 · Note
• http://secunia.com/advisories/11314 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15774 · Note
• http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0077.html · Note
• http://marc.info/?l=bugtraq&m=108135350810135&w=2 · Note
• http://securityfocus.com/bid/10070 · Note