Format string vulnerability in Real HelixPlayer and RealPlayer 10 allows remote attackers to execute arbitrary code via the (1) image handle or (2) timeformat attribute in a RealPix (.rp) or RealText (.rt) file.

An updated RealPlayer package that fixes a format string bug is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

RealPlayer is a media player that provides media playback locally and via streaming.

A format string bug was discovered in the way RealPlayer processes RealPix (.rp) files. It is possible for a malformed RealPix file to execute arbitrary code as the user running RealPlayer. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2710 to this issue.

All users of RealPlayer are advised to upgrade to this updated package, which contains RealPlayer version 10.0.6 and is not vulnerable to this issue.

An updated HelixPlayer package that fixes a string format issue is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

HelixPlayer is a media player.

A format string bug was discovered in the way HelixPlayer processes RealPix (.rp) files. It is possible for a malformed RealPix file to execute arbitrary code as the user running HelixPlayer. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2710 to this issue.

All users of HelixPlayer are advised to upgrade to this updated package, which contains HelixPlayer version 10.0.6 and is not vulnerable to this issue.

The remote host is affected by the vulnerability described in GLSA-200510-07 (RealPlayer, Helix Player: Format string vulnerability)

    'c0ntex' reported that RealPlayer and Helix Player suffer from a heap     overflow.
  Impact :

    By enticing a user to play a specially crafted realpix (.rp) or     realtext (.rt) file, an attacker could execute arbitrary code with the     permissions of the user running the application.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:788 advisory.

    HelixPlayer is a media player.

    A format string bug was discovered in the way HelixPlayer processes RealPix     (.rp) files. It is possible for a malformed RealPix file to execute     arbitrary code as the user running HelixPlayer. The Common Vulnerabilities     and Exposures project (cve.mitre.org) has assigned the name CAN-2005-2710     to this issue.

    All users of HelixPlayer are advised to upgrade to this updated package,     which contains HelixPlayer version 10.0.6 and is not vulnerable to this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security vulnerabilities have been identified in the helix-player media player that could allow an attacker to execute code on the victim's machine via specially crafted network resources.

  - CAN-2005-1766     Buffer overflow in the RealText parser could allow     remote code execution via a specially crafted RealMedia     file with a long RealText string.

  - CAN-2005-2710

    Format string vulnerability in Real HelixPlayer and     RealPlayer 10 allows remote attackers to execute     arbitrary code via the image handle attribute in a     RealPix (.rp) or RealText (.rt) file.

ID	Name	Product	Family	Severity
63829	RHEL 3 / 4 : RealPlayer (RHSA-2005:762)	Nessus	Red Hat Local Security Checks	high
23983	CentOS 4 : Helix / Player (CESA-2005:788)	Nessus	CentOS Local Security Checks	high
19977	GLSA-200510-07 : RealPlayer, Helix Player: Format string vulnerability	Nessus	Gentoo Local Security Checks	medium
19836	RHEL 4 : HelixPlayer (RHSA-2005:788)	Nessus	Red Hat Local Security Checks	critical
19795	Debian DSA-826-1 : helix-player - multiple vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2005-2710

critical

Tenable Plugins

high

high

medium

critical

medium