Buffer overflow in the Unescape function in common/util/hxurl.cpp and player/hxclientkit/src/CHXClientSink.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a URL argument containing a % (percent) character that is not followed by two hex digits.

From Red Hat Security Advisory 2010:0094 :

An updated HelixPlayer package that fixes several security issues is now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

HelixPlayer is a media player.

Multiple buffer and integer overflow flaws were found in the way HelixPlayer processed Graphics Interchange Format (GIF) files. An attacker could create a specially crafted GIF file which would cause HelixPlayer to crash or, potentially, execute arbitrary code when opened. (CVE-2009-4242, CVE-2009-4245)

A buffer overflow flaw was found in the way HelixPlayer processed Synchronized Multimedia Integration Language (SMIL) files. An attacker could create a specially crafted SMIL file which would cause HelixPlayer to crash or, potentially, execute arbitrary code when opened. (CVE-2009-4257)

A buffer overflow flaw was found in the way HelixPlayer handled the Real Time Streaming Protocol (RTSP) SET_PARAMETER directive. A malicious RTSP server could use this flaw to crash HelixPlayer or, potentially, execute arbitrary code. (CVE-2009-4248)

Multiple buffer overflow flaws were discovered in the way HelixPlayer handled RuleBook structures in media files and RTSP streams. Specially crafted input could cause HelixPlayer to crash or, potentially, execute arbitrary code. (CVE-2009-4247, CVE-2010-0417)

A buffer overflow flaw was found in the way HelixPlayer performed URL un-escaping. A specially crafted URL string could cause HelixPlayer to crash or, potentially, execute arbitrary code. (CVE-2010-0416)

All HelixPlayer users are advised to upgrade to this updated package, which contains backported patches to resolve these issues. All running instances of HelixPlayer must be restarted for this update to take effect.

Multiple buffer and integer overflow flaws were found in the way HelixPlayer processed Graphics Interchange Format (GIF) files. An attacker could create a specially crafted GIF file which would cause HelixPlayer to crash or, potentially, execute arbitrary code when opened. (CVE-2009-4242, CVE-2009-4245)

A buffer overflow flaw was found in the way HelixPlayer processed Synchronized Multimedia Integration Language (SMIL) files. An attacker could create a specially crafted SMIL file which would cause HelixPlayer to crash or, potentially, execute arbitrary code when opened. (CVE-2009-4257)

A buffer overflow flaw was found in the way HelixPlayer handled the Real Time Streaming Protocol (RTSP) SET_PARAMETER directive. A malicious RTSP server could use this flaw to crash HelixPlayer or, potentially, execute arbitrary code. (CVE-2009-4248)

Multiple buffer overflow flaws were discovered in the way HelixPlayer handled RuleBook structures in media files and RTSP streams. Specially crafted input could cause HelixPlayer to crash or, potentially, execute arbitrary code. (CVE-2009-4247, CVE-2010-0417)

A buffer overflow flaw was found in the way HelixPlayer performed URL un-escaping. A specially crafted URL string could cause HelixPlayer to crash or, potentially, execute arbitrary code. (CVE-2010-0416)

All running instances of HelixPlayer must be restarted for this update to take effect.

The security support of Real Player 10 was discontinued a while ago by Real Networks.

As there are known critical security problems in Real Player 10 and we are unable to fix them nor update to Real Player 11, we are disabling this player.

The media player of SUSE Linux Enterprise Desktop 10, Helix Banshee, has been switched to use the Fluendo GSTreamer MP3 codec included in this update to keep MP3 playing abilities.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2010:0094 advisory.

  - HelixPlayer / RealPlayer: GIF file heap overflow (CVE-2009-4242)

  - HelixPlayer / RealPlayer: compressed GIF heap overflow (CVE-2009-4245)

  - HelixPlayer / RealPlayer: RTSP client ASM RuleBook stack buffer overflow (CVE-2009-4247)

  - HelixPlayer / RealPlayer: RTSP SET_PARAMETER buffer overflow (CVE-2009-4248)

  - HelixPlayer / RealPlayer: SMIL getAtom heap buffer overflow (CVE-2009-4257)

  - HelixPlayer / RealPlayer: URL unescape buffer overflow (CVE-2010-0416)

  - HelixPlayer / RealPlayer: rule book handling heap corruption (CVE-2010-0417)

  - HelixPlayer multiple flaws (CVE-2010-2997, CVE-2010-4375, CVE-2010-4378, CVE-2010-4379, CVE-2010-4382,     CVE-2010-4383, CVE-2010-4385, CVE-2010-4386, CVE-2010-4392, CVE-2010-4376) (CVE-2010-4376)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An updated HelixPlayer package that fixes several security issues is now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

HelixPlayer is a media player.

Multiple buffer and integer overflow flaws were found in the way HelixPlayer processed Graphics Interchange Format (GIF) files. An attacker could create a specially crafted GIF file which would cause HelixPlayer to crash or, potentially, execute arbitrary code when opened. (CVE-2009-4242, CVE-2009-4245)

A buffer overflow flaw was found in the way HelixPlayer processed Synchronized Multimedia Integration Language (SMIL) files. An attacker could create a specially crafted SMIL file which would cause HelixPlayer to crash or, potentially, execute arbitrary code when opened. (CVE-2009-4257)

A buffer overflow flaw was found in the way HelixPlayer handled the Real Time Streaming Protocol (RTSP) SET_PARAMETER directive. A malicious RTSP server could use this flaw to crash HelixPlayer or, potentially, execute arbitrary code. (CVE-2009-4248)

Multiple buffer overflow flaws were discovered in the way HelixPlayer handled RuleBook structures in media files and RTSP streams. Specially crafted input could cause HelixPlayer to crash or, potentially, execute arbitrary code. (CVE-2009-4247, CVE-2010-0417)

A buffer overflow flaw was found in the way HelixPlayer performed URL un-escaping. A specially crafted URL string could cause HelixPlayer to crash or, potentially, execute arbitrary code. (CVE-2010-0416)

All HelixPlayer users are advised to upgrade to this updated package, which contains backported patches to resolve these issues. All running instances of HelixPlayer must be restarted for this update to take effect.

ID	Name	Product	Family	Severity
67994	Oracle Linux 4 : HelixPlayer (ELSA-2010-0094)	Nessus	Oracle Linux Local Security Checks	high
60729	Scientific Linux Security Update : HelixPlayer on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
51689	SuSE 10 Security Update : Realplayer and banshee (ZYPP Patch Number 7122)	Nessus	SuSE Local Security Checks	high
44430	RHEL 4 : HelixPlayer (RHSA-2010:0094)	Nessus	Red Hat Local Security Checks	high
44428	CentOS 4 : HelixPlayer (CESA-2010:0094)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2010-0416

high

Tenable Plugins

high

high

high

high

high