RealPlayer/RealOne "DUNZIP32.dll" Buffer Overflow Vulnerability

[ronjor]

Highly critical

Secunia (http://secunia.com/advisories/12869/)

-{ Quote: "The vulnerability is caused due to a boundary error in a 3rd-party compression library (DUNZIP32.dll) when processing skin files. This can be exploited to cause a buffer overflow via a specially crafted skin file" }-

[still_longhorn]

A buffer overflow condition exists due to insufficient bounds checking of fields in skinfiles. There is an unchecked buffer for the "CONTROLnImage" field of the "skin.ini" file. By supplying an overly long filename as a value for this field, it is possible to overwrite stack variables. An attacker may exploit this condition to overwrite the return address with a pointer to embedded attacker-supplied instructions.
To exploit this issue the attacker must transmit the maliciously constructed skinfile to a victim of the attack. This may be done via a webpage or HTML e-mail. Exploitation of this issue may result in execution of attacker-supplied instructions with the privileges of the user opening the malicious skinfile.

A proof-of-concept has been provided. The following must be saved in a zipfile and the extension must be changed to .rjs:
[MAIN]
SkinFamilyCount=5
CONTROL1Image=aaaaaaaaaa... long'a'
If this example is loaded with a web browser, the Real application will be called and will crash.
Exploit code has been released by UNYUN <unyun@shadowpenguin.org>:
realjukebox2_exploit.c

Fixes are available:
Real Networks RealOne Player Gold for Windows 6.0.10 .505:
Real Networks Patch skinpatchr11s.rmp
http://www.service.real.com/help/faq/security/07092002/skinpatchr11s.rmp