RealPlayer/RealOne "DUNZIP32.dll" Buffer Overflow Vulnerability

Discussion in 'other security issues & news' started by ronjor, Oct 27, 2004.

Thread Status:
Not open for further replies.
  1. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,727
    Location:
    Texas
    Highly critical

    Secunia

     
  2. still_longhorn

    still_longhorn Registered Member

    Joined:
    Oct 3, 2004
    Posts:
    256
    A buffer overflow condition exists due to insufficient bounds checking of fields in skinfiles. There is an unchecked buffer for the "CONTROLnImage" field of the "skin.ini" file. By supplying an overly long filename as a value for this field, it is possible to overwrite stack variables. An attacker may exploit this condition to overwrite the return address with a pointer to embedded attacker-supplied instructions.
    To exploit this issue the attacker must transmit the maliciously constructed skinfile to a victim of the attack. This may be done via a webpage or HTML e-mail. Exploitation of this issue may result in execution of attacker-supplied instructions with the privileges of the user opening the malicious skinfile.

    A proof-of-concept has been provided. The following must be saved in a zipfile and the extension must be changed to .rjs:
    [MAIN]
    SkinFamilyCount=5
    CONTROL1Image=aaaaaaaaaa... long'a'
    If this example is loaded with a web browser, the Real application will be called and will crash.
    Exploit code has been released by UNYUN <unyun@shadowpenguin.org>:
    realjukebox2_exploit.c

    Fixes are available:
    Real Networks RealOne Player Gold for Windows 6.0.10 .505:
    Real Networks Patch skinpatchr11s.rmp
    http://www.service.real.com/help/faq/security/07092002/skinpatchr11s.rmp
     
Loading...
Thread Status:
Not open for further replies.