RealPlayer/RealOne users, note

Discussion in 'other security issues & news' started by Phil, Nov 22, 2002.

Thread Status:
Not open for further replies.
  1. Phil

    Phil Registered Member

    Oct 24, 2002
    Quote from NTBugTraq:

    NGSSoftware Insight Security Research Advisory

    Name: Multiple Buffer Overruns RealOne / RealPlayer / RealOne Enterprise
    Systems Affected: Windows All
    Severity: Critical
    Category: Remote Buffer Overrun
    Vendor URL:
    Author: Mark Litchfield (
    Date: 22nd November 2002
    Advisory number: #NISR22112002

    RealOne / RealPlayer is one of the most widely used products for internet
    media delivery. According to Real, there are currently around 115 million
    users worlwide of these products. RealOne is the updated version of
    RealPlayer. Both suffer from multiple overrun issues.

    This advisory details three remotely exploitable overruns, two being heap
    based overflows and the other being a stack based overflow. On exploitation
    of these overruns any supplied code would execute in the security context of
    the logged on user.

    1) By following a link to a SMIL file (Synchronized Multimedia Integration
    Language), RealPlayer will automatically download the file in an attempt to
    play its content. By suppling an overly long paramter within the SMIL file
    a heap overflow would occur in RealPlay.exe. According to Real, they have
    fixed the issue by fixing the player status code to handle the cases where
    there are large number of characters in the metadata of a smil file.

    2) By suppling an overly long rtsp:// filename parameter, for example
    within a .m3u file, when a link was followed, Real again would download the
    file. When play is selected a heap overflow ocurrs in RealPlay.exe This
    has apparently been fixed by Real by improving the robustness of URL
    handling in this portion of the product.

    3) Again, referring to number two if the 'victim' were to download the file
    with a large filename (whether it was on local/rtsp or an http url) Real
    Player would access violate when performing the following: If the user were
    to right click in Now Playing and select "Edit Clip info" or right click in
    "Now Playing" and "Select copy to my Library". In this particular instance
    a stack overflow would occur in RealPlayer.

    Fix Information
    NGSSoftware alerted Real to these problems on the 1st November 2002.
    NGSSoftware highly recommend installing the patch found at
    Alternatively if you Open RealPlayer - Help - About Real Player, you will
    notice a Check For Updates feature. Select this.

    In Real's own advisory they omit the fact that RealOne Enterprise Desktop is
    also vulnerable, but only to issues 2 & 3.

    Further Information
    For further information about the scope and effects of buffer overflows,
    please see
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.