The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the (1) Console or (2) Controls property, which allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via a series of assignments of long string values, which triggers an overwrite of freed heap memory.

According to its version number, the installed version of RealPlayer / RealPlayer Enterprise on the remote Windows host suffers from possibly several issues :

  - Heap memory corruption issues in several ActiveX controls can lead to arbitrary code execution (CVE-2008-1309).
  - An unspecified local resource reference vulnerability (CVE-2008-3064).
  - An SWF file heap-based buffer overflow (CVE-2007-5400).
  - A buffer overflow involving the 'import()' method in an ActiveX control implemented by the 'rjbdll.dll' module could result in arbitrary code execution (CVE-2008-3066).

Note that RealPlayer 11 (builds 6.0.14.738 - 6.0.14.802) are only affected by the first issue (CVE-2008-1309).
Note that the vendor's advisory states that version numbers for RealPlayer 10.5 are not sequential.

According to its build number, the installed version of RealPlayer / on the remote Windows host suffers from possibly several issues :

  - Heap memory corruption issues in several ActiveX     controls can lead to arbitrary code execution.
    (CVE-2008-1309)

  - An unspecified local resource reference vulnerability.
    (CVE-2008-3064)

  - An SWF file heap-based buffer overflow. (CVE-2007-5400)

  - A buffer overflow involving the 'import()' method in an     ActiveX control implemented by the 'rjbdll.dll' module     could result in arbitrary code execution.
    (CVE-2008-3066)

Note that RealPlayer 11 (builds 6.0.14.738 - 6.0.14.802) are only affected by the first issue (CVE-2008-1309).

The remote host contains the Real Player ActiveX control, included with the RealPlayer media player, used to play content in a browser. 

The version of this control installed on the remote host reportedly contains a buffer overflow that can be leveraged by calls to various methods, such as 'Console', to modify heap blocks after they are freed and overwrite certain registers.  If an attacker can trick a user on the affected host into visiting a specially crafted web page, he may be able to use this method to execute arbitrary code on the affected system subject to the user's privileges.

ID	Name	Product	Family	Severity
4608	RealPlayer for Windows < 6.0.14.806 / 6.0.12.1675 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
33744	RealPlayer for Windows < Build 6.0.14.806 / 6.0.12.1675 Multiple Vulnerabilities	Nessus	Windows	high
31418	RealPlayer ActiveX (rmoc3260.dll) Console Property Memory Corruption Arbitrary Code Execution	Nessus	Windows	high

Detections

Analytics

CVE-2008-1309

critical

Tenable Plugins

medium

high

high