PT-2004-2391 · Realnetworks · Realplayer+1

Published 2004-12-31 · Updated 2021-08-11 · CVE-2004-1481

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RealPlayer versions 8 through 10.5 (6.0.12.1040) and earlier RealOne Player versions 1 or 2

Description The issue is caused by an integer overflow in the pnen3260.dll component, which can be exploited by remote attackers to execute arbitrary code. This is achieved through a SMIL file and a .rm movie file containing a large length field for the data chunk, resulting in a heap-based buffer overflow.

Recommendations For RealPlayer versions 8 through 10.5 (6.0.12.1040) and earlier, update to a version later than 10.5 (6.0.12.1040) to resolve the issue. For RealOne Player versions 1 or 2, consider disabling the pnen3260.dll component as a temporary workaround until a patch is available.

Fix

Related Identifiers

CVE-2004-1481

Affected Products

Realone Player

Realplayer

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2004-1481 · Security Note
• http://securityfocus.com/bid/11309 · Patch
• http://secunia.com/advisories/12672 · Note
• http://marc.info/?l=ntbugtraq&m=109708374115061&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17549 · Note
• http://service.real.com/help/faq/security/040928_player/EN · Note