Detections
Analytics

RealPlayer 18.1.5.x < 18.1.5.694 (Win) RCE

high Nessus Network Monitor Plugin ID 700137

Synopsis

The remote host is running a version of RealPlayer multimedia application that may be vulnerable to a Remote Code Execution (RCE) attack vector.

Description

Versions of RealPlayer 18.1.5.x prior to 18.1.5.694 on Windows are potentially affected by a flaw that is triggered when loading certain dynamic-link libraries. The program uses an insecure path to look for specific files or libraries that includes the current working directory, which may not be trusted or under user control. By placing a specially crafted library in the path, a local attacker can inject and execute arbitrary code with the privilege of the user running the program.

Solution

Windows users should upgrade to RealPlayer 18.1.5.694 or later.

See Also

https://customer.real.com/hc/en-us/articles/214793317

Plugin Details

Severity: High

ID: 700137

Family: Web Clients

Published: 6/16/2017

Updated: 3/6/2019

Vulnerability Information

CPE: cpe:/a:realnetworks:realplayer

Patch Publication Date: 12/20/2016

Vulnerability Publication Date: 12/20/2016

Reference Information

CVE: CVE-2016-9930