Detections
Analytics

RealPlayer < 6.0.12.1059 Multiple Remote Overflows

high Nessus Network Monitor Plugin ID 2666

Synopsis

The remote host is vulnerable to a buffer overflow.

Description

The remote host has the RealPlayer software installed.

There are several flaws in the remote version of this software that might allow
an attacker to execute arbitrary code and delete arbitrary files on the remote
host.

To exploit these flaws, an attacker would need to send a malformed SMIL or
WAV file to a user on the remote host and wait for the file to be opened in RealPlayer.

Solution

Upgrade to version 6.0.12.1059 or higher.

See Also

http://www.idefense.com/application/poi/display?id=209&type=vulnerabilities

http://www.securityfocus.com/archive/1/391959

http://service.real.com/help/faq/security/050224_player/EN

Plugin Details

Severity: High

ID: 2666

Family: Web Clients

Published: 3/2/2005

Updated: 3/6/2019

Nessus ID: 17254

Risk Information

VPR

Risk Factor: High

Score: 8.5

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:realnetworks:realplayer

Exploitable With

Metasploit (RealNetworks RealPlayer SMIL Buffer Overflow)

Reference Information

CVE: CVE-2005-0455, CVE-2005-0611

BID: 12697, 12698