full-disclosure - TPTI-10-17: RealNetworks RealPlayer SIPR Stream Frame Dimensions Remote Code Execution Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 10 Dec 2010 15:51:08 -0600
From: ZDI Disclosures <zdi-disclosures@...pingpoint.com>
To: "'Full Disclosure (full-disclosure@...ts.grok.org.uk)'"
	<full-disclosure@...ts.grok.org.uk>,
	"'Bugtraq (bugtraq@...urityfocus.com)'" <bugtraq@...urityfocus.com>
Subject: TPTI-10-17: RealNetworks RealPlayer SIPR Stream
 Frame Dimensions Remote Code Execution Vulnerability

TPTI-10-17: RealNetworks RealPlayer SIPR Stream Frame Dimensions Remote Code Execution Vulnerability

http://dvlabs.tippingpoint.com/advisory/TPTI-10-17

December 10, 2010

-- CVE ID:
CVE-2010-4385

-- CVSS:
9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)

-- Affected Vendors:
RealNetworks

-- Affected Products:
RealNetworks RealPlayer

-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 9674.
For further product information on the TippingPoint IPS, visit:

    http://www.tippingpoint.com

-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of RealNetworks RealPlayer. Authentication is
not required to exploit this vulnerability.

The specific flaw exists within the drv1.dll module. Code responsible
for parsing SIPR stream metadata trusts frame width and height values
from the input file. By crafting particular values an integer value used
in a loop can be made to wrap negatively. The loop will subsequently
overflow a static heap buffer during an inline memory copy. By crafting
a malicious .rm file an attacker can exploit this vulnerability remotely
using the RealPlayer ActiveX control.

-- Vendor Response:
RealNetworks has issued an update to correct this vulnerability. More
details can be found at:

http://service.real.com/realplayer/security/12102010_player/en/

-- Disclosure Timeline:
2010-02-26 - Vulnerability reported to vendor
2010-12-10 - Coordinated public release of advisory

-- Credit:
This vulnerability was discovered by:
    * Aaron Portnoy, Zef Cekaj, Logan Brown



Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/