|
|
|
|
| |
Credit:
The information has been provided by Aaron Portnoy, Zef Cekaj and Logan Brown.
The original article can be found at: http://dvlabs.tippingpoint.com/advisory/TPTI-10-17
|
| |
Vulnerable Systems:
* RealNetworks RealPlayer
Authentication is not required to exploit this vulnerability.
The specific flaw exists within the drv1.dll module. Code responsible for parsing SIPR stream metadata trusts frame width and height values from the input file. By crafting particular values an integer value used in a loop can be made to wrap negatively. The loop will subsequently overflow a static heap buffer during an inline memory copy. By crafting a malicious .rm file an attacker can exploit this vulnerability remotely using the RealPlayer ActiveX control.
Patch Availability:
RealNetworks has issued an update to correct this vulnerability. More details can be found at http://service.real.com/realplayer/security/12102010_player/en/
CVE Information:
CVE-2010-4385
Disclosure Timeline:
2010-02-26 - Vulnerability reported to vendor
2010-12-10 - Coordinated public release of advisory
|
|
|
|
|
