PT-2010-4472 · Realnetworks · Linux Realplayer+3

Published 2010-12-10 · Updated 2011-01-19 · CVE-2010-2999

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RealPlayer versions 11.0 through 11.1 RealPlayer SP versions 1.0 through 1.0.1 Mac RealPlayer versions 11.0 through 11.1 Linux RealPlayer version 11.0.2.1744

Description The issue allows remote attackers to execute arbitrary code or cause a denial of service due to heap memory corruption via a malformed MLLT atom in an AAC file.

Recommendations For RealPlayer versions 11.0 through 11.1, consider disabling the parsing of MLLT atoms in AAC files until a patch is available. For RealPlayer SP versions 1.0 through 1.0.1, restrict access to AAC files to minimize the risk of exploitation. For Mac RealPlayer versions 11.0 through 11.1, avoid using the affected AAC parsing functionality until the issue is resolved. For Linux RealPlayer version 11.0.2.1744, as a temporary workaround, consider disabling the playback of AAC files until a patch is available.

Fix

RCE

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2010-2999

ZDI-10-273

Affected Products

Linux Realplayer

Mac Realplayer

Realplayer

Realplayer Sp

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2010-2999 · Security Note
• http://service.real.com/realplayer/security/12102010_player/en · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-10-273 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-10-273 · Note
• http://securitytracker.com/id?1024861 · Note