Heap-based buffer overflow in RealNetworks RealPlayer 8, 10, 10.1, and possibly 10.5; RealOne Player 1 and 2; and RealPlayer Enterprise allows remote attackers to execute arbitrary code via a crafted RM file.

An updated RealPlayer package that fixes a security flaw is now available for Red Hat Enterprise Linux 3 Extras, 4 Extras, and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

RealPlayer is a media player that provides media playback locally and via streaming.

A buffer overflow flaw was found in the way RealPlayer processed Synchronized Multimedia Integration Language (SMIL) files. It was possible for a malformed SMIL file to execute arbitrary code with the permissions of the user running RealPlayer. (CVE-2007-3410)

All users of RealPlayer are advised to upgrade to this updated package containing RealPlayer version 10.0.9 which is not vulnerable to this issue.

Secunia reports :

Multiple vulnerabilities have been reported in RealPlayer/RealOne/HelixPlayer, which can be exploited by malicious people to compromise a user's system.

An input validation error when processing .RA/.RAM files can be exploited to cause a heap corruption via a specially crafted .RA/.RAM file with an overly large size field in the header.

An error in the processing of .PLS files can be exploited to cause a memory corruption and execute arbitrary code via a specially crafted .PLS file.

An input validation error when parsing .SWF files can be exploited to cause a buffer overflow via a specially crafted .SWF file with malformed record headers.

A boundary error when processing rm files can be exploited to cause a buffer overflow.

According to its build number, the installed version of RealPlayer / RealOne Player / RealPlayer Enterprise on the remote Windows host suffers from several buffer overflows involving specially crafted media files (eg, '.mp3', '.rm', '.SMIL', '.swf', '.ram', and '.pls'). If an attacker can trick a user on the affected system into opening such a file or browsing to a specially crafted web page, he may be able to exploit one of these issues to execute arbitrary code subject to the user's privileges on the affected host.

ID	Name	Product	Family	Severity
40707	RHEL 3 / 4 / 5 : RealPlayer (RHSA-2007:0841)	Nessus	Red Hat Local Security Checks	high
29866	FreeBSD : linux-realplayer -- multiple vulnerabilities (f762ccbb-baed-11dc-a302-000102cc8983)	Nessus	FreeBSD Local Security Checks	high
27591	RealPlayer for Windows < Build 6.0.12.1662 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2007-5081

high

Tenable Plugins

high

high

high