PT-2010-1338 · Realnetworks+1 · Realplayer+2

Tomas Hoger · Published 2010-01-25 · Updated 2017-09-19 · CVE-2009-4248

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RealPlayer versions 10 through 11.0.4 RealPlayer 10.5 versions 6.0.12.1040 through 6.0.12.1741 RealPlayer Enterprise (affected versions not specified) Mac RealPlayer versions 10 and 10.1 Linux RealPlayer version 10 Helix Player versions 10.x

Description The issue is related to a buffer overflow in the RTSPProtocol::HandleSetParameterRequest function, which can be triggered by a crafted RTSP SET PARAMETER request. This could lead to a denial of service, causing the application to crash, or possibly allow the execution of arbitrary code. The estimated number of potentially affected devices and details about real-world incidents are not provided.

Recommendations For RealPlayer versions 10 through 11.0.4, consider disabling the RTSPProtocol::HandleSetParameterRequest function until a patch is available. For RealPlayer 10.5 versions 6.0.12.1040 through 6.0.12.1741, restrict access to the RTSP SET PARAMETER request to minimize the risk of exploitation. For RealPlayer Enterprise, Mac RealPlayer versions 10 and 10.1, Linux RealPlayer version 10, and Helix Player versions 10.x, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-4248

RHSA-2010:0094

RHSA-2010_0094

Affected Products

Helix Player

Realplayer

Red Hat

References · 27

• http://securitytracker.com/id?1023489 · Patch
• http://service.real.com/realplayer/security/01192010_player/en · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0094.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4248 · Security Note
• http://secunia.com/advisories/38218 · Vendor Advisory
• http://vupen.com/english/advisories/2010/0178 · Vendor Advisory
• http://lists.helixcommunity.org/pipermail/client-cvs/2008-January/003759.html · Note
• http://xforce.iss.net/xforce/xfdb/55801 · Note
• https://access.redhat.com/security/cve/CVE-2010-0416 · Note
• https://access.redhat.com/security/cve/CVE-2009-4242 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/55801 · Note
• http://secunia.com/advisories/38450 · Note
• https://access.redhat.com/security/cve/CVE-2009-4247 · Note
• https://access.redhat.com/errata/RHSA-2010:0094 · Note
• https://access.redhat.com/security/cve/CVE-2009-4245 · Note