|
|
| |
Credit:
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-10-271/
|
| |
Vulnerable Systems:
* RealNetworks RealPlayer
The specific flaw exists in the parsing of GIF87a files over the streaming protocol RTSP. When specifying a large Screen Width size in the Screen Descriptor header a calculation on the destination heap chunks size is improperly checked for overflow. This leads to a smaller buffer being allocated and subsequently a heap overflow when processing the received data. Exploitation of this vulnerability can lead to system compromise under the credentials of the currently logged in user.
Patch Availability:
RealNetworks has issued an update to correct this vulnerability. More details can be found at
http://service.real.com/realplayer/security/12102010_player/en/
CVE Information:
CVE-2010-4376
Disclosure Timeline:
2009-06-25 - Vulnerability reported to vendor
2010-12-10 - Coordinated public release of advisory
|
|
|
