PT-2010-1336 · Realnetworks · Realplayer+1

Peter Vreugdenhil · Published 2010-01-21 · Updated 2018-10-10 · CVE-2009-4246

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RealPlayer versions 6.0.12.1040 through 6.0.12.1741 RealPlayer versions 11.0.0 through 11.0.4 RealPlayer Enterprise (affected versions not specified) Mac RealPlayer versions 10 and 10.1 Linux RealPlayer version 10 Helix Player versions 10.x

Description The issue is a stack-based buffer overflow that allows user-assisted remote attackers to execute arbitrary code via a malformed .RJS skin file. This file contains a web.xmb file with crafted length values.

Recommendations For RealPlayer versions 6.0.12.1040 through 6.0.12.1741, update to a version outside of this range to resolve the issue. For RealPlayer versions 11.0.0 through 11.0.4, update to a version later than 11.0.4 to resolve the issue. For RealPlayer Enterprise, Mac RealPlayer versions 10 and 10.1, Linux RealPlayer version 10, and Helix Player versions 10.x, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-4246

ZDI-10-010

Affected Products

Helix Player

Realplayer

References · 11

• http://zerodayinitiative.com/advisories/ZDI-10-010 · Patch
• http://secunia.com/advisories/38218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4246 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-10-010 · Security Note
• http://vupen.com/english/advisories/2010/0178 · Vendor Advisory
• http://securitytracker.com/id?1023489 · Patch
• http://service.real.com/realplayer/security/01192010_player/en · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55799 · Note
• http://xforce.iss.net/xforce/xfdb/55799 · Note
• http://securityfocus.com/bid/37880 · Note
• http://securityfocus.com/archive/1/509104/100/0/threaded · Note