RealPlayer/RealOne "DUNZIP32.dll" Buffer Overflow Vulnerability

Discussion in 'other security issues & news' started by ronjor, Oct 27, 2004.

Thread Status:
Not open for further replies.
  1. ronjor

    ronjor Global Moderator

    Jul 21, 2003
    Highly critical


  2. still_longhorn

    still_longhorn Registered Member

    Oct 3, 2004
    A buffer overflow condition exists due to insufficient bounds checking of fields in skinfiles. There is an unchecked buffer for the "CONTROLnImage" field of the "skin.ini" file. By supplying an overly long filename as a value for this field, it is possible to overwrite stack variables. An attacker may exploit this condition to overwrite the return address with a pointer to embedded attacker-supplied instructions.
    To exploit this issue the attacker must transmit the maliciously constructed skinfile to a victim of the attack. This may be done via a webpage or HTML e-mail. Exploitation of this issue may result in execution of attacker-supplied instructions with the privileges of the user opening the malicious skinfile.

    A proof-of-concept has been provided. The following must be saved in a zipfile and the extension must be changed to .rjs:
    CONTROL1Image=aaaaaaaaaa... long'a'
    If this example is loaded with a web browser, the Real application will be called and will crash.
    Exploit code has been released by UNYUN <>:

    Fixes are available:
    Real Networks RealOne Player Gold for Windows 6.0.10 .505:
    Real Networks Patch skinpatchr11s.rmp
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.