Buffer overflow in Real Networks RealPlayer 10 allows remote attackers to execute arbitrary code via a URL with a large number of "." (period) characters.

Updated realplayer packages that fix a number of security issues are now available for Red Hat Enterprise Linux 3 Extras.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The realplayer package contains RealPlayer, a media format player.

A number of security issues have been discovered in RealPlayer 8 of which a subset are believed to affect the Linux version as shipped with Red Hat Enterprise Linux 3 Extras. RealPlayer 8 is no longer supported by RealNetworks.

Users of RealPlayer are advised to upgrade to this erratum package which contains RealPlayer 10.

According to its version number, the version of Realplayer is vulnerable to several remote overflows.
Realplayer is a multimedia player.  An attacker exploiting this flaw would need to be able to convince a local user into visiting a malicious URL or downloading a malicious RealPlayer media file that would execute code with the privileges of the local user. 

According to its build number, the installed version of RealPlayer on the remote host is vulnerable to several overflows.  In exploiting these flaws, an attacker would need to be able to coerce a local user into visiting a malicious URL or downloading a malicious media file which, on execution, would execute code with the privileges of the local user.

ID	Name	Product	Family	Severity
17590	RHEL 3 : realplayer (RHSA-2005:299)	Nessus	Red Hat Local Security Checks	high
2472	RealPlayer Unspecified Remote Buffer Overflow	Nessus Network Monitor	Web Clients	high
14278	RealPlayer Multiple Remote Overflows	Nessus	Windows	high

Detections

Analytics

CVE-2004-0550

critical

Tenable Plugins

high

high

high