PT-2004-3655 · Real · Realplayer

John Heasman · Published 2004-09-29 · Updated 2017-11-16 · CVE-2005-0190

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions RealPlayer versions 10.5 (6.0.12.1040) and earlier

Description A directory traversal issue allows remote attackers to delete arbitrary files via a Real Metadata Packages (RMP) file. This is achieved by including a FILENAME tag with .. (dot dot) sequences in a filename that ends with a ? (question mark) and an allowed file extension, such as .mp3, which bypasses the file extension check.

Recommendations For RealPlayer versions 10.5 (6.0.12.1040) and earlier, consider restricting the handling of RMP files with suspicious FILENAME tags to minimize the risk of exploitation. Avoid using the FILENAME tag with .. sequences in filenames until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-0190

Affected Products

Realplayer

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2005-0190 · Security Note
• http://ngssoftware.com/advisories/real-02full.txt · Vendor Advisory
• http://service.real.com/help/faq/security/040928_player/EN · Vendor Advisory
• http://secunia.com/advisories/12672 · Vendor Advisory
• http://securityfocus.com/bid/11308 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=109707741022291&w=2 · Note
• http://marc.info/?l=bugtraq&m=110616160228843&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17551 · Note