Realplayer .SWF Multiple Remote Memory Corruption Vulnerabilities

Advisory Content :

Realplayer .SWF Multiple Remote Memory Corruption Vulnerabilities

By Sowhat of Nevis Labs
Date: 2006.03.22

http://www.nevisnetworks.com
http://secway.org/advisory/AD20060322.txt

CVE: CVE-2006-0323
US CERT: VU#231028

Vendor
RealNetworks Inc.

Products affected:

Windows
RealPlayer 8
RealOne Player & RealOne Player V2
RealPlayer 10
RealPlayer 10.5

Macintosh
RealOne Player
RealPlayer 10

Linux
RealPlayer 10

Overview:

RealPlayer is an application for playing various media formats,
developed by RealNetworks Inc. For more information, visit
http://www.real.com/.

Details:

There are multiple vulnerabilities found in swfformat.dll.
A carefully crafted .swf file may execute arbitrary code or crash the
RealPlayer.

By persuading a user to access a specially crafted SWF file with
RealPlayer,
a remote attacker may be able to execute arbitrary code.
And also, these vulnerabilities can be triggered remotely through ActiveX
in IE.

By setting the size of SWF files to a value smaller than the actual size,
you can trigger one of the vulnerabilities.

Actually, there are multiple holes that have been fixed in swfformat.dll.

POC:

No PoC will be released for this.

FIX:

http://service.real.com/realplayer/security/03162006_player/en/

Vendor Response:

2005.10.07 Vendor notified via email
2005.10.07 Vendor responded
2005.03.22 Patch released
2006.04.11 Advisory released

Common Vulnerabilities and Exposures (CVE) Information:

The Common Vulnerabilities and Exposures (CVE) project has assigned
the following names to these issues. These are candidates for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems.

CVE-2006-0323

Greetings to Paul Gese (at) real (dot) com [email concealed], Chi, OYXin,
Narasimha Datta and all
Nevis Labs guys.

References:

1. http://service.real.com/realplayer/security/03162006_player/en/
2. http://www.kb.cert.org/vuls/id/231028
3. http://www.macromedia.com/licensing/developer/fileformat/faq/
4. http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0323
5. http://www.gentoo.org/security/en/glsa/glsa-200603-24.xml
6. http://www.novell.com/linux/security/advisories/2006_18_realplayer.html
7. http://secunia.com/advisories/19358/

--
Sowhat
http://secway.org
"Life is like a bug, Do you know how to exploit it ?"

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Realplayer .SWF Multiple Remote Memory Corruption Vulnerabilities