Stack-based buffer overflow in the SmilTimeValue::parseWallClockValue function in smlprstime.cpp in RealNetworks RealPlayer 10, 10.1, and possibly 10.5, RealOne Player, RealPlayer Enterprise, and Helix Player 10.5-GOLD and 10.0.5 through 10.0.8, allows remote attackers to execute arbitrary code via an SMIL (SMIL2) file with a long wallclock value.

From Red Hat Security Advisory 2007:0605 :

An updated HelixPlayer package that fixes a buffer overflow flaw is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

HelixPlayer is a media player.

A buffer overflow flaw was found in the way HelixPlayer processed Synchronized Multimedia Integration Language (SMIL) files. It was possible for a malformed SMIL file to execute arbitrary code with the permissions of the user running HelixPlayer. (CVE-2007-3410)

All users of HelixPlayer are advised to upgrade to this updated package, which contains a backported patch and is not vulnerable to this issue.

A buffer overflow flaw was found in the way HelixPlayer processed Synchronized Multimedia Integration Language (SMIL) files. It was possible for a malformed SMIL file to execute arbitrary code with the permissions of the user running HelixPlayer. (CVE-2007-3410)

An updated RealPlayer package that fixes a security flaw is now available for Red Hat Enterprise Linux 3 Extras, 4 Extras, and 5 Supplementary.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

RealPlayer is a media player that provides media playback locally and via streaming.

A buffer overflow flaw was found in the way RealPlayer processed Synchronized Multimedia Integration Language (SMIL) files. It was possible for a malformed SMIL file to execute arbitrary code with the permissions of the user running RealPlayer. (CVE-2007-3410)

All users of RealPlayer are advised to upgrade to this updated package containing RealPlayer version 10.0.9 which is not vulnerable to this issue.

Secunia reports :

Multiple vulnerabilities have been reported in RealPlayer/RealOne/HelixPlayer, which can be exploited by malicious people to compromise a user's system.

An input validation error when processing .RA/.RAM files can be exploited to cause a heap corruption via a specially crafted .RA/.RAM file with an overly large size field in the header.

An error in the processing of .PLS files can be exploited to cause a memory corruption and execute arbitrary code via a specially crafted .PLS file.

An input validation error when parsing .SWF files can be exploited to cause a buffer overflow via a specially crafted .SWF file with malformed record headers.

A boundary error when processing rm files can be exploited to cause a buffer overflow.

A buffer overflow flaw was discovered in the way RealPlayer and HelixPlayer handle the wallclock variable in Synchronized Multimedia Integration Language (SMIL) files.

More information regarding this flaw can be found here:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=5 47

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its build number, the installed version of RealPlayer / RealOne Player / RealPlayer Enterprise on the remote Windows host suffers from several buffer overflows involving specially crafted media files (eg, '.mp3', '.rm', '.SMIL', '.swf', '.ram', and '.pls'). If an attacker can trick a user on the affected system into opening such a file or browsing to a specially crafted web page, he may be able to exploit one of these issues to execute arbitrary code subject to the user's privileges on the affected host.

The remote host is affected by the vulnerability described in GLSA-200709-05 (RealPlayer: Buffer overflow)

    A stack-based buffer overflow vulnerability has been reported in the     SmilTimeValue::parseWallClockValue() function in smlprstime.cpp when     handling HH:mm:ss.f type time formats.
  Impact :

    By enticing a user to open a specially crafted SMIL (Synchronized     Multimedia Integration Language) file, an attacker could be able to     execute arbitrary code with the privileges of the user running the     application.
  Workaround :

    There is no known workaround at this time.

An updated HelixPlayer package that fixes a buffer overflow flaw is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

HelixPlayer is a media player.

A buffer overflow flaw was found in the way HelixPlayer processed Synchronized Multimedia Integration Language (SMIL) files. It was possible for a malformed SMIL file to execute arbitrary code with the permissions of the user running HelixPlayer. (CVE-2007-3410)

All users of HelixPlayer are advised to upgrade to this updated package, which contains a backported patch and is not vulnerable to this issue.

According to its build number, the installed version of RealPlayer on the remote Windows host contains a stack-based buffer overflow that can be triggered by a specially crafted SMIL file, perhaps accessed over the web using the CLSID 'CFCDAA03-8BE4-11cf-B84B-0020AFBBCCFA'.
A remote attacker may be able to exploit this issue to execute arbitrary code subject to the user's privileges on the affected host.

ID	Name	Product	Family	Severity
67538	Oracle Linux 4 : HelixPlayer (ELSA-2007-0605)	Nessus	Oracle Linux Local Security Checks	high
60220	Scientific Linux Security Update : HelixPlayer on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
40707	RHEL 3 / 4 / 5 : RealPlayer (RHSA-2007:0841)	Nessus	Red Hat Local Security Checks	high
29866	FreeBSD : linux-realplayer -- multiple vulnerabilities (f762ccbb-baed-11dc-a302-000102cc8983)	Nessus	FreeBSD Local Security Checks	high
27679	Fedora 7 : HelixPlayer-1.0.7-6.fc7 (2007-0756)	Nessus	Fedora Local Security Checks	high
27591	RealPlayer for Windows < Build 6.0.12.1662 Multiple Vulnerabilities	Nessus	Windows	high
26095	GLSA-200709-05 : RealPlayer: Buffer overflow	Nessus	Gentoo Local Security Checks	high
25624	RHEL 4 : HelixPlayer (RHSA-2007:0605)	Nessus	Red Hat Local Security Checks	high
25614	CentOS 4 : HelixPlayer (CESA-2007:0605)	Nessus	CentOS Local Security Checks	high
25573	RealPlayer for Windows < Build 6.0.12.1578 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2007-3410

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high