Heap-based buffer overflow in the embedded player in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, and Helix Player allows remote malicious servers to cause a denial of service (crash) and possibly execute arbitrary code via a chunked Transfer-Encoding HTTP response in which either (1) the chunk header length is specified as -1, (2) the chunk header with a length that is less than the actual amount of sent data, or (3) a missing chunk header.

An updated RealPlayer package that fixes a format string bug is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

RealPlayer is a media player that provides media playback locally and via streaming.

A format string bug was discovered in the way RealPlayer processes RealPix (.rp) files. It is possible for a malformed RealPix file to execute arbitrary code as the user running RealPlayer. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2710 to this issue.

All users of RealPlayer are advised to upgrade to this updated package, which contains RealPlayer version 10.0.6 and is not vulnerable to this issue.

An updated HelixPlayer package that fixes a string format issue is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

HelixPlayer is a media player.

A format string bug was discovered in the way HelixPlayer processes RealPix (.rp) files. It is possible for a malformed RealPix file to execute arbitrary code as the user running HelixPlayer. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2710 to this issue.

All users of HelixPlayer are advised to upgrade to this updated package, which contains HelixPlayer version 10.0.6 and is not vulnerable to this issue.

iDefense Reports :

Remote exploitation of a heap-based buffer overflow in RealNetwork Inc's RealPlayer could allow the execution of arbitrary code in the context of the currently logged in user.

In order to exploit this vulnerability, an attacker would need to entice a user to follow a link to a malicious server. Once the user visits a website under the control of an attacker, it is possible in a default install of RealPlayer to force a web-browser to use RealPlayer to connect to an arbitrary server, even when it is not the default application for handling those types, by the use of embedded object tags in a webpage. This may allow automated exploitation when the page is viewed.

According to its build number, the installed version of RealPlayer / RealOne Player / RealPlayer Enterprise on the remote Windows host suffers from one or more buffer overflows involving maliciously- crafted SWF and MBC files as well as web pages.  In addition, it also may be affected by a local privilege escalation issue.

The installed version of RealPlayer on the remote host is prone to buffer overflow vulnerabilities.  An attacker may be able to leverage these issues to execute arbitrary code on the remote host subject to the permissions of the user running the affected application.  Note that a user doesn't necessarily need to explicitly access a malicious media file since the browser may automatically pass the file to the RealPlayer application. 

According to its banner, the version of iTunes for Windows on the remote host launches a helper application by searching for it through various system paths.  An attacker with local access can leverage this issue to place a malicious program in a system path and have it called before the helper application.

The installed version of RealPlayer / RealOne Player / RealPlayer Enterprise for Windows on the remote host is prone to buffer overflow and heap overflow vulnerabilities.  An attacker may be able to leverage these issues to execute arbitrary code on the remote host subject to the permissions of the user running the affected application.  Note that a user doesn't necessarily need to explicitly access a malicious media file since the browser may automatically pass RealPlayer skin files (ie, files with the extension '.rjs') to the application.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:788 advisory.

    HelixPlayer is a media player.

    A format string bug was discovered in the way HelixPlayer processes RealPix     (.rp) files. It is possible for a malformed RealPix file to execute     arbitrary code as the user running HelixPlayer. The Common Vulnerabilities     and Exposures project (cve.mitre.org) has assigned the name CAN-2005-2710     to this issue.

    All users of HelixPlayer are advised to upgrade to this updated package,     which contains HelixPlayer version 10.0.6 and is not vulnerable to this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
63829	RHEL 3 / 4 : RealPlayer (RHSA-2005:762)	Nessus	Red Hat Local Security Checks	high
23983	CentOS 4 : Helix / Player (CESA-2005:788)	Nessus	CentOS Local Security Checks	high
21544	FreeBSD : linux-realplayer -- heap overflow (fe4c84fc-bdb5-11da-b7d4-00123ffe8333)	Nessus	FreeBSD Local Security Checks	high
21140	RealPlayer for Windows < Build 6.0.12.1483 Multiple Vulnerabilities	Nessus	Windows	high
3485	RealPlayer for Linux, Mac, and Windows Remote Overflows	Nessus Network Monitor	Web Clients	medium
3296	iTunes For Windows < 6.0 Local Code Execution	Nessus Network Monitor	Web Clients	medium
3286	RealPlayer for Windows Multiple Overflows (2)	Nessus Network Monitor	Web Clients	medium
19836	RHEL 4 : HelixPlayer (RHSA-2005:788)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2005-2922

critical

Tenable Plugins

high

high

high

high

medium

medium

medium

critical