Heap-based buffer overflow in RealNetworks RealPlayer 10.5 (6.0.12.1056 and earlier), 10, 8, and RealOne Player V2 and V1, allows remote attackers to execute arbitrary code via .WAV files.

Two exploits have been identified in the Linux RealPlayer client.
RealNetworks states :

RealNetworks, Inc. has addressed recently discovered security vulnerabilities that offered the potential for an attacker to run arbitrary or malicious code on a customer's machine. RealNetworks has received no reports of machines compromised as a result of the now-remedied vulnerabilities. RealNetworks takes all security vulnerabilities very seriously.

The specific exploits were :

- Exploit 1: To fashion a malicious WAV file to cause a buffer overflow which could have allowed an attacker to execute arbitrary code on a customer's machine.

- Exploit 2: To fashion a malicious SMIL file to cause a buffer overflow which could have allowed an attacker to execute arbitrary code on a customer's machine.

Updated realplayer packages that fix a number of security issues are now available for Red Hat Enterprise Linux 3 Extras.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The realplayer package contains RealPlayer, a media format player.

A number of security issues have been discovered in RealPlayer 8 of which a subset are believed to affect the Linux version as shipped with Red Hat Enterprise Linux 3 Extras. RealPlayer 8 is no longer supported by RealNetworks.

Users of RealPlayer are advised to upgrade to this erratum package which contains RealPlayer 10.

The remote host is missing the patch for the advisory SUSE-SA:2005:014 (RealPlayer).


Two security problems were found in the media player RealPlayer:

- CVE-2005-0455: A buffer overflow in the handling of .smil files.
- CVE-2005-0611: A buffer overflow in the handling of .wav files.

Both buffer overflows can be exploited remotely by providing URLs opened by RealPlayer.

More informations can be found on this URL:
http://service.real.com/help/faq/security/050224_player/EN/

This updates fixes the problems.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:271 advisory.

    HelixPlayer is a media player.

    A stack based buffer overflow bug was found in HelixPlayer's Synchronized     Multimedia Integration Language (SMIL) file processor. An attacker could     create a specially crafted SMIL file which would execute arbitrary code     when opened by a user. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-0455 to this issue.

    A buffer overflow bug was found in the way HelixPlayer decodes WAV files.
    An attacker could create a specially crafted WAV file which could execute     arbitrary code when opened by a user. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2005-0611 to     this issue.

    All users of HelixPlayer are advised to upgrade to this updated package,     which contains HelixPlayer 1.0.3 which is not vulnerable to these     issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An updated RealPlayer package that fixes two buffer overflow issues is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

RealPlayer is a media player.

A stack based buffer overflow bug was found in RealPlayer's Synchronized Multimedia Integration Language (SMIL) file processor. An attacker could create a specially crafted SMIL file which would execute arbitrary code when opened by a user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0455 to this issue.

A buffer overflow bug was found in the way RealPlayer decodes WAV sound files. An attacker could create a specially crafted WAV file which could execute arbitrary code when opened by a user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0611 to this issue.

All users of RealPlayer are advised to upgrade to this updated package, which contains RealPlayer version 10.0.3 and is not vulnerable to these issues.

The remote host has the RealPlayer software installed.

There are several flaws in the remote version of this software that might allow
an attacker to execute arbitrary code and delete arbitrary files on the remote
host.

To exploit these flaws, an attacker would need to send a malformed SMIL or
WAV file to a user on the remote host and wait for the file to be opened in RealPlayer. 

According to its build number, the installed version of RealPlayer / RealOne Player / RealPlayer Enterprise for Windows might allow an attacker to execute arbitrary code and delete arbitrary files on the remote host. 

To exploit these flaws, an attacker would send a malformed SMIL or WAV file to a user on the remote host and wait for him to open it.

ID	Name	Product	Family	Severity
19116	FreeBSD : realplayer -- remote heap overflow (c73305ae-8cd7-11d9-9873-000a95bc6fae)	Nessus	FreeBSD Local Security Checks	medium
17590	RHEL 3 : realplayer (RHSA-2005:299)	Nessus	Red Hat Local Security Checks	high
17300	SUSE-SA:2005:014: RealPlayer	Nessus	SuSE Local Security Checks	medium
17269	RHEL 4 : HelixPlayer (RHSA-2005:271)	Nessus	Red Hat Local Security Checks	critical
17268	RHEL 4 : RealPlayer (RHSA-2005:265)	Nessus	Red Hat Local Security Checks	medium
2666	RealPlayer < 6.0.12.1059 Multiple Remote Overflows	Nessus Network Monitor	Web Clients	high
17254	RealPlayer Multiple Remote Overflows (2005-03-01)	Nessus	Windows	high

Detections

Analytics

CVE-2005-0611

critical

Tenable Plugins

medium

high

medium

critical

medium

high

high