|
|
|
|
| |
Credit:
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-10-278/
|
| |
Vulnerable Systems:
* RealNetworks RealPlayer
The specific flaw exists within the Custsupport.html component of the RealPlayer default installation. Due to a failure to properly sanitize user-supplied input, it is possible for an attacker to inject arbitrary code into the RealOneActiveXObject process. This can be abused to bypass the Local Machine Zone security policy and load unsafe controls. Successful exploitation of this issue leads to remote code execution under the context of the RealPlayer application.
Patch Availability:
RealNetworks has issued an update to correct this vulnerability. More details can be found at
http://service.real.com/realplayer/security/12102010_player/en/
CVE Information:
CVE-2010-4388
Disclosure Timeline:
2010-07-20 - Vulnerability reported to vendor
2010-12-10 - Coordinated public release of advisory
|
|
|
|
|
