Two exploits have been identified in the Linux RealPlayer client.
RealNetworks states :

RealNetworks, Inc. has addressed recently discovered security vulnerabilities that offered the potential for an attacker to run arbitrary or malicious code on a customer's machine. RealNetworks has received no reports of machines compromised as a result of the now-remedied vulnerabilities. RealNetworks takes all security vulnerabilities very seriously.

The specific exploits were :

- Exploit 1: To fashion a malicious WAV file to cause a buffer overflow which could have allowed an attacker to execute arbitrary code on a customer's machine.

- Exploit 2: To fashion a malicious SMIL file to cause a buffer overflow which could have allowed an attacker to execute arbitrary code on a customer's machine.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:271 advisory.

    HelixPlayer is a media player.

    A stack based buffer overflow bug was found in HelixPlayer's Synchronized     Multimedia Integration Language (SMIL) file processor. An attacker could     create a specially crafted SMIL file which would execute arbitrary code     when opened by a user. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-0455 to this issue.

    A buffer overflow bug was found in the way HelixPlayer decodes WAV files.
    An attacker could create a specially crafted WAV file which could execute     arbitrary code when opened by a user. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2005-0611 to     this issue.

    All users of HelixPlayer are advised to upgrade to this updated package,     which contains HelixPlayer 1.0.3 which is not vulnerable to these     issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated realplayer packages that fix a number of security issues are now available for Red Hat Enterprise Linux 3 Extras.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The realplayer package contains RealPlayer, a media format player.

A number of security issues have been discovered in RealPlayer 8 of which a subset are believed to affect the Linux version as shipped with Red Hat Enterprise Linux 3 Extras. RealPlayer 8 is no longer supported by RealNetworks.

Users of RealPlayer are advised to upgrade to this erratum package which contains RealPlayer 10.

According to its build number, the installed version of RealPlayer / RealOne Player / RealPlayer Enterprise for Windows might allow an attacker to execute arbitrary code and delete arbitrary files on the remote host. 

To exploit these flaws, an attacker would send a malformed SMIL or WAV file to a user on the remote host and wait for him to open it.

The remote host is missing the patch for the advisory SUSE-SA:2005:014 (RealPlayer).


Two security problems were found in the media player RealPlayer:

- CVE-2005-0455: A buffer overflow in the handling of .smil files.
- CVE-2005-0611: A buffer overflow in the handling of .wav files.

Both buffer overflows can be exploited remotely by providing URLs opened by RealPlayer.

More informations can be found on this URL:
http://service.real.com/help/faq/security/050224_player/EN/

This updates fixes the problems.

An updated RealPlayer package that fixes two buffer overflow issues is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

RealPlayer is a media player.

A stack based buffer overflow bug was found in RealPlayer's Synchronized Multimedia Integration Language (SMIL) file processor. An attacker could create a specially crafted SMIL file which would execute arbitrary code when opened by a user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0455 to this issue.

A buffer overflow bug was found in the way RealPlayer decodes WAV sound files. An attacker could create a specially crafted WAV file which could execute arbitrary code when opened by a user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0611 to this issue.

All users of RealPlayer are advised to upgrade to this updated package, which contains RealPlayer version 10.0.3 and is not vulnerable to these issues.

The remote host has the RealPlayer software installed.

There are several flaws in the remote version of this software that might allow
an attacker to execute arbitrary code and delete arbitrary files on the remote
host.

To exploit these flaws, an attacker would need to send a malformed SMIL or
WAV file to a user on the remote host and wait for the file to be opened in RealPlayer. 

ID	Name	Product	Family	Published	Updated	Severity
19116	FreeBSD : realplayer -- remote heap overflow (c73305ae-8cd7-11d9-9873-000a95bc6fae)	Nessus	FreeBSD Local Security Checks	7/13/2005	1/6/2021	medium
17269	RHEL 4 : HelixPlayer (RHSA-2005:271)	Nessus	Red Hat Local Security Checks	3/4/2005	11/4/2024	critical
17590	RHEL 3 : realplayer (RHSA-2005:299)	Nessus	Red Hat Local Security Checks	3/21/2005	1/14/2021	high
17254	RealPlayer Multiple Remote Overflows (2005-03-01)	Nessus	Windows	3/2/2005	11/15/2018	high
17300	SUSE-SA:2005:014: RealPlayer	Nessus	SuSE Local Security Checks	3/9/2005	1/14/2021	medium
17268	RHEL 4 : RealPlayer (RHSA-2005:265)	Nessus	Red Hat Local Security Checks	3/4/2005	1/14/2021	medium
2666	RealPlayer < 6.0.12.1059 Multiple Remote Overflows	Nessus Network Monitor	Web Clients	3/2/2005	3/6/2019	high

Detections

Analytics

Plugins Search

medium

critical

high

high

medium

medium

high