Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.1, Mac RealPlayer 11.0 through 11.1, and Linux RealPlayer 11.0.2.1744 allows remote attackers to execute arbitrary code via a large Screen Width value in the Screen Descriptor header of a GIF87a file in an RTSP stream.

According to its build number, the installed version of RealPlayer on the remote Windows host is affected by multiple vulnerabilities:

  - An error in the 'Cook' codec initialization function     and can be used to access uninitialized memory.     (CVE-2010-0121)

  - Freed pointer access in the handling of the 'Stream     Title' tag in a SHOUTcast stream using the ICY protocol.
    (CVE-2010-2997)

  - An integer overflow error exists when handling a     malformed 'MLLT atom' in an AAC file. (CVE-2010-2999)

  - Heap-based buffer overflow when handling of multi-rate     audio streams. (CVE-2010-4375)

  - Heap-based buffer overflow when parsing GIF87a files     with large 'Screen Width' values in the 'Screen     Descriptor' header over RTSP. (CVE-2010-4376)

  - Heap-based buffer overflow when parsing of 'Cook' codec     information in a Real Audio file with many subbands.
    (CVE-2010-4377)

  - Memory corruption in parsing of a 'RV20' video stream.
    (CVE-2010-4378)

  - Heap-based buffer overflow when parsing 'AAC', 'IVR',     'RealMedia', 'RA5', 'RealPix', 'SIPR' and 'SOUND' files.
    (CVE-2010-0125, CVE-2010-4379, CVE-2010-4380,      CVE-2010-4381, CVE-2010-4382, CVE-2010-4383,      CVE-2010-4384, CVE-2010-4386, CVE-2010-4387,      CVE-2010-4390, CVE-2010-4391, CVE-2010-4392)

  - Integer overflow in the handling of frame dimensions in     a 'SIPR' stream. (CVE-2010-4385)

  - An input validation error in the 'pnen3260.dll' module     can allow arbitrary code execution via a crafted 'TIT2     atom' in an AAC file. (CVE-2010-4397)

  - Heap-based buffer overflow in the 'Cook' codec handling     functions. (CVE-2010-2579, CVE-2010-4389)

  - Heap-based buffer overflow in the decoding portion of     the 'Advanced Audio Coding' compression implementation.     (CVE-2010-4395)

  - Cross-site scripting in ActiveX control and several     HTML files. (CVE-2010-4396, CVE-2010-4388)

The remote host is running RealPlayer, a multi-media application.

RealPlayer builds earlier than 12.0.1.609 are potentially affected by vulnerabilities :

  - An uncontrolled array index vulnerability exists in RealMedia media properties. (CVE-2010-4384)

  - A heap overflow vulnerability exists in multi-rate audio handling. (CVE-2010-4375)

  - A heap corruption vulnerability exists in the SMIL file format StreamTitle. (CVE-2010-2997)

  - An integer overflow exists in AAC MLLT Atom parsing. (CVE-2010-2999)

  - An integer overflow exists in AAC TIT2 Atom parsing. (CVE-2010-4397)

  - A heap overflow vulnerability exists in RTSP GIF parsing. (CVE-2010-4376)

  - A heap corruption vulnerability exist in the Cook Audio Codec. (CVE-2010-4377)

  - A heap corruption vulnerability exists in RV20 parsing. (CVE-2010-4378)

  - An error exists in the Cook codec initialization function. (CVE-2010-0121)

  - A memory access vulnerability exists in the Cook codec relating to an uninitialized number of channels. (CVE-2010-2579)

  - An unspecified vulnerability exists in AAC spectral data parsing. (CVE-2010-0125)

  - A heap overflow vulnerability exists in SIPR. (CVE-2010-4379)

  - A heap overflow exists in SOUND. (CVE-2010-4380)

  - A heap overflow exists in AAC. (CVE-2010-4381)

  - Multiple heap overflow vulnerabilities in RealMedia. (CVE-2010-4382)

  - A heap overflow vulnerability in RA5. (CVE-2010-4383)

  - An integer overflow in SIPR stream frame dimensions. (CVE-2010-4385)

  - RealMedia Memory heap corruption. (CVE-2010-4386)

  - A memory corruption vulnerability in the RealAudio codec. (CVE-2010-4387)

  - A cross-zone scripting vulnerability in the ActiveX HandleAction Method. (CVE-2010-4396)

  - A cross domain scripting vulnerability is exploitable via local HTML files. (CVE-2010-4388)

  - A heap overflow vulnerability exists in the Cook codec initialization buffer index.(CVE-2010-4389)

  - A heap overflow vulnerability exists in the IVR file header. (CVE-2010-4390)

  - A heap overflow vulnerability exists in the RMX header. (CVE-2010-4391)

  - A heap overflow vulnerability exists in ImageMap. (CVE-2010-4392)

  - A heap overflow vulnerability exists in RealPix server header. (CVE-2010-4394)

  - A heap overflow exists in the Advanced audio coding. (CVE-2010-4395)

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2010:0094 advisory.

  - HelixPlayer / RealPlayer: GIF file heap overflow (CVE-2009-4242)

  - HelixPlayer / RealPlayer: compressed GIF heap overflow (CVE-2009-4245)

  - HelixPlayer / RealPlayer: RTSP client ASM RuleBook stack buffer overflow (CVE-2009-4247)

  - HelixPlayer / RealPlayer: RTSP SET_PARAMETER buffer overflow (CVE-2009-4248)

  - HelixPlayer / RealPlayer: SMIL getAtom heap buffer overflow (CVE-2009-4257)

  - HelixPlayer / RealPlayer: URL unescape buffer overflow (CVE-2010-0416)

  - HelixPlayer / RealPlayer: rule book handling heap corruption (CVE-2010-0417)

  - HelixPlayer multiple flaws (CVE-2010-2997, CVE-2010-4375, CVE-2010-4378, CVE-2010-4379, CVE-2010-4382,     CVE-2010-4383, CVE-2010-4385, CVE-2010-4386, CVE-2010-4392, CVE-2010-4376) (CVE-2010-4376)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
50612	RealPlayer for Windows < Build 12.0.1.609 Multiple Vulnerabilities	Nessus	Windows	critical
5709	Real Networks RealPlayer < 14.0.1.609 (Build 12.0.1.609) Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
44430	RHEL 4 : HelixPlayer (RHSA-2010:0094)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2010-4376

critical

Tenable Plugins

critical

medium

high