Unquoted Windows search path vulnerability in RealNetworks RealPlayer 10.5 6.0.12.1040 through 6.0.12.1348, RealPlayer 10, RealOne Player v2, RealOne Player v1, and RealPlayer 8 before 20060322 might allow local users to gain privileges via a malicious C:\program.exe file.

According to its build number, the installed version of RealPlayer / RealOne Player / RealPlayer Enterprise on the remote Windows host suffers from one or more buffer overflows involving maliciously- crafted SWF and MBC files as well as web pages.  In addition, it also may be affected by a local privilege escalation issue.

According to its banner, the version of iTunes for Windows on the remote host launches a helper application by searching for it through various system paths.  An attacker with local access can leverage this issue to place a malicious program in a system path and have it called before the helper application.

The installed version of RealPlayer / RealOne Player / RealPlayer Enterprise for Windows on the remote host is prone to buffer overflow and heap overflow vulnerabilities.  An attacker may be able to leverage these issues to execute arbitrary code on the remote host subject to the permissions of the user running the affected application.  Note that a user doesn't necessarily need to explicitly access a malicious media file since the browser may automatically pass RealPlayer skin files (ie, files with the extension '.rjs') to the application.

ID	Name	Product	Family	Severity
21140	RealPlayer for Windows < Build 6.0.12.1483 Multiple Vulnerabilities	Nessus	Windows	high
3296	iTunes For Windows < 6.0 Local Code Execution	Nessus Network Monitor	Web Clients	medium
3286	RealPlayer for Windows Multiple Overflows (2)	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2005-2936

high

Tenable Plugins

high

medium

medium