PT-2004-3654 · Realnetworks · Realplayer

John Heasman · Published 2004-10-06 · Updated 2017-11-16 · CVE-2005-0189

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RealPlayer versions prior to 10.5 (6.0.12.1040)

Description The issue is related to a stack-based buffer overflow in the HandleAction function. This allows remote attackers to execute arbitrary code via a long ShowPreferences argument.

Recommendations For versions prior to 10.5 (6.0.12.1040), consider updating to a version that is not affected by this issue. As a temporary workaround, restrict the use of the HandleAction function until a patch is available. Avoid using long ShowPreferences arguments in the affected API endpoint until the issue is resolved.

Fix

Related Identifiers

CVE-2005-0189

Affected Products

Realplayer

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2005-0189 · Security Note
• http://securityfocus.com/bid/12311 · Vendor Advisory
• http://archives.neohapsis.com/archives/ntbugtraq/2005-q1/0046.html · Vendor Advisory
• http://kb.cert.org/vuls/id/698390 · Patch
• http://service.real.com/help/faq/security/040928_player/EN · Vendor Advisory
• http://marc.info/?l=bugtraq&m=109707741022291&w=2 · Note
• http://marc.info/?l=bugtraq&m=110616636318261&w=2 · Note