Use-after-free vulnerability in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.0.1, Mac RealPlayer 11.0 through 11.1, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted StreamTitle tag in an ICY SHOUTcast stream, related to the SMIL file format.

From Red Hat Security Advisory 2010:0981 :

Helix Player contains multiple security flaws and should no longer be used.  This update removes the HelixPlayer package from Red Hat Enterprise Linux 4. 

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Helix Player is a media player.

Multiple security flaws were discovered in RealPlayer. Helix Player and RealPlayer share a common source code base; therefore, some of the flaws discovered in RealPlayer may also affect Helix Player. Some of these flaws could, when opening, viewing, or playing a malicious media file or stream, lead to arbitrary code execution with the privileges of the user running Helix Player. (CVE-2010-2997, CVE-2010-4375, CVE-2010-4378, CVE-2010-4379, CVE-2010-4382, CVE-2010-4383, CVE-2010-4384, CVE-2010-4385, CVE-2010-4386, CVE-2010-4392)

The Red Hat Security Response Team is unable to properly determine the impact or fix all of these issues in Helix Player, due to the source code for RealPlayer being unavailable.

Due to the security concerns this update removes the HelixPlayer package from Red Hat Enterprise Linux 4. Users wishing to continue to use Helix Player should download it directly from https://player.helixcommunity.org/

Multiple security flaws were discovered in RealPlayer. Helix Player and RealPlayer share a common source code base; therefore, some of the flaws discovered in RealPlayer may also affect Helix Player. Some of these flaws could, when opening, viewing, or playing a malicious media file or stream, lead to arbitrary code execution with the privileges of the user running Helix Player. (CVE-2010-2997, CVE-2010-4375, CVE-2010-4378, CVE-2010-4379, CVE-2010-4382, CVE-2010-4383, CVE-2010-4384, CVE-2010-4385, CVE-2010-4386, CVE-2010-4392)

Our removal packages have nothing in them but a README, so the HelixPlayer program will be removed from your SL 4 machine, but you will still have a package called HelixPlayer.

Note: Just to be clear. You will still have a package called HelixPlayer on your machine, but there will not be any program in it.
It will be an empty rpm.

Helix Player contains multiple security flaws and should no longer be used. This update removes the HelixPlayer package from Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Helix Player is a media player.

Multiple security flaws were discovered in RealPlayer. Helix Player and RealPlayer share a common source code base; therefore, some of the flaws discovered in RealPlayer may also affect Helix Player. Some of these flaws could, when opening, viewing, or playing a malicious media file or stream, lead to arbitrary code execution with the privileges of the user running Helix Player. (CVE-2010-2997, CVE-2010-4375, CVE-2010-4378, CVE-2010-4379, CVE-2010-4382, CVE-2010-4383, CVE-2010-4384, CVE-2010-4385, CVE-2010-4386, CVE-2010-4392)

The Red Hat Security Response Team is unable to properly determine the impact or fix all of these issues in Helix Player, due to the source code for RealPlayer being unavailable.

Due to the security concerns this update removes the HelixPlayer package from Red Hat Enterprise Linux 4. Users wishing to continue to use Helix Player should download it directly from https://player.helixcommunity.org/

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2010:0981 advisory.

  - HelixPlayer multiple flaws (CVE-2010-2997, CVE-2010-4375, CVE-2010-4378, CVE-2010-4379, CVE-2010-4382,     CVE-2010-4383, CVE-2010-4385, CVE-2010-4386, CVE-2010-4392, CVE-2010-4376) (CVE-2010-2997, CVE-2010-4375,     CVE-2010-4378, CVE-2010-4379, CVE-2010-4382, CVE-2010-4383, CVE-2010-4384, CVE-2010-4385, CVE-2010-4386,     CVE-2010-4392)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its build number, the installed version of RealPlayer on the remote Windows host is affected by multiple vulnerabilities:

  - An error in the 'Cook' codec initialization function     and can be used to access uninitialized memory.     (CVE-2010-0121)

  - Freed pointer access in the handling of the 'Stream     Title' tag in a SHOUTcast stream using the ICY protocol.
    (CVE-2010-2997)

  - An integer overflow error exists when handling a     malformed 'MLLT atom' in an AAC file. (CVE-2010-2999)

  - Heap-based buffer overflow when handling of multi-rate     audio streams. (CVE-2010-4375)

  - Heap-based buffer overflow when parsing GIF87a files     with large 'Screen Width' values in the 'Screen     Descriptor' header over RTSP. (CVE-2010-4376)

  - Heap-based buffer overflow when parsing of 'Cook' codec     information in a Real Audio file with many subbands.
    (CVE-2010-4377)

  - Memory corruption in parsing of a 'RV20' video stream.
    (CVE-2010-4378)

  - Heap-based buffer overflow when parsing 'AAC', 'IVR',     'RealMedia', 'RA5', 'RealPix', 'SIPR' and 'SOUND' files.
    (CVE-2010-0125, CVE-2010-4379, CVE-2010-4380,      CVE-2010-4381, CVE-2010-4382, CVE-2010-4383,      CVE-2010-4384, CVE-2010-4386, CVE-2010-4387,      CVE-2010-4390, CVE-2010-4391, CVE-2010-4392)

  - Integer overflow in the handling of frame dimensions in     a 'SIPR' stream. (CVE-2010-4385)

  - An input validation error in the 'pnen3260.dll' module     can allow arbitrary code execution via a crafted 'TIT2     atom' in an AAC file. (CVE-2010-4397)

  - Heap-based buffer overflow in the 'Cook' codec handling     functions. (CVE-2010-2579, CVE-2010-4389)

  - Heap-based buffer overflow in the decoding portion of     the 'Advanced Audio Coding' compression implementation.     (CVE-2010-4395)

  - Cross-site scripting in ActiveX control and several     HTML files. (CVE-2010-4396, CVE-2010-4388)

The remote host is running RealPlayer, a multi-media application.

RealPlayer builds earlier than 12.0.1.609 are potentially affected by vulnerabilities :

  - An uncontrolled array index vulnerability exists in RealMedia media properties. (CVE-2010-4384)

  - A heap overflow vulnerability exists in multi-rate audio handling. (CVE-2010-4375)

  - A heap corruption vulnerability exists in the SMIL file format StreamTitle. (CVE-2010-2997)

  - An integer overflow exists in AAC MLLT Atom parsing. (CVE-2010-2999)

  - An integer overflow exists in AAC TIT2 Atom parsing. (CVE-2010-4397)

  - A heap overflow vulnerability exists in RTSP GIF parsing. (CVE-2010-4376)

  - A heap corruption vulnerability exist in the Cook Audio Codec. (CVE-2010-4377)

  - A heap corruption vulnerability exists in RV20 parsing. (CVE-2010-4378)

  - An error exists in the Cook codec initialization function. (CVE-2010-0121)

  - A memory access vulnerability exists in the Cook codec relating to an uninitialized number of channels. (CVE-2010-2579)

  - An unspecified vulnerability exists in AAC spectral data parsing. (CVE-2010-0125)

  - A heap overflow vulnerability exists in SIPR. (CVE-2010-4379)

  - A heap overflow exists in SOUND. (CVE-2010-4380)

  - A heap overflow exists in AAC. (CVE-2010-4381)

  - Multiple heap overflow vulnerabilities in RealMedia. (CVE-2010-4382)

  - A heap overflow vulnerability in RA5. (CVE-2010-4383)

  - An integer overflow in SIPR stream frame dimensions. (CVE-2010-4385)

  - RealMedia Memory heap corruption. (CVE-2010-4386)

  - A memory corruption vulnerability in the RealAudio codec. (CVE-2010-4387)

  - A cross-zone scripting vulnerability in the ActiveX HandleAction Method. (CVE-2010-4396)

  - A cross domain scripting vulnerability is exploitable via local HTML files. (CVE-2010-4388)

  - A heap overflow vulnerability exists in the Cook codec initialization buffer index.(CVE-2010-4389)

  - A heap overflow vulnerability exists in the IVR file header. (CVE-2010-4390)

  - A heap overflow vulnerability exists in the RMX header. (CVE-2010-4391)

  - A heap overflow vulnerability exists in ImageMap. (CVE-2010-4392)

  - A heap overflow vulnerability exists in RealPix server header. (CVE-2010-4394)

  - A heap overflow exists in the Advanced audio coding. (CVE-2010-4395)

ID	Name	Product	Family	Severity
68166	Oracle Linux 4 : HelixPlayer removal (ELSA-2010-0981)	Nessus	Oracle Linux Local Security Checks	high
60923	Scientific Linux Security Update : HelixPlayer on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
51782	CentOS 4 : HelixPlayer removal (CESA-2010:0981)	Nessus	CentOS Local Security Checks	high
51183	RHEL 4 : HelixPlayer removal (Critical) (RHSA-2010:0981)	Nessus	Red Hat Local Security Checks	critical
50612	RealPlayer for Windows < Build 12.0.1.609 Multiple Vulnerabilities	Nessus	Windows	critical
5709	Real Networks RealPlayer < 14.0.1.609 (Build 12.0.1.609) Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2010-2997

high

Tenable Plugins

high

high

high

critical

critical

medium