Heap-based buffer overflow in the Shockwave Flash (SWF) frame handling in RealNetworks RealPlayer 10.5 Build 6.0.12.1483 might allow remote attackers to execute arbitrary code via a crafted SWF file.

The remote host is affected by the vulnerability described in GLSA-201312-11 (Win32 Codecs: User-assisted execution of arbitrary code)

    A heap-based buffer overflow exists when handling Shockwave Flash files.
  Impact :

    A remote attacker could entice a user to open a specially crafted Flash       file using a package linked against Win32 Codecs, possibly resulting in       execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

RealPlayer 10 is vulnerable to a critical security problem in the flash plugin (CVE-2007-5400). Real does not provide updated binaries of RealPlayer 10 and SUSE is not allowed to ship RealPlayer 11.
Therefore this update disables the flash plugin by setting restrictive file system permissions.

RealPlayer 10.0.9 as shipped in Red Hat Enterprise Linux 3 Extras, 4 Extras, and 5 Supplementary, contains a security flaw and should not be used.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

[Updated 17 September 2008] We have updated this erratum to include packages which remove RealPlayer from Red Hat Enterprise Linux 3 Extras, 4 Extras and 5 Supplementary.

RealPlayer is a media player that provides media playback locally and via streaming.

RealPlayer 10.0.9 is vulnerable to a critical security flaw and should no longer be used. A remote attacker could leverage this flaw to execute arbitrary code as the user running RealPlayer. (CVE-2007-5400)

This issue is addressed in RealPlayer 11. Red Hat is unable to ship RealPlayer 11 due to additional proprietary codecs included in that version. Therefore, users who wish to continue to use RealPlayer should get an update directly from www.real.com.

This update removes the RealPlayer 10.0.9 packages due to their known security vulnerabilities.

The remote host is affected by the vulnerability described in GLSA-200809-03 (RealPlayer: Buffer overflow)

    Dyon Balding of Secunia Research reported an unspecified heap-based     buffer overflow in the Shockwave Flash (SWF) frame handling.
  Impact :

    By enticing a user to open a specially crafted SWF (Shockwave Flash)     file, a remote attacker could be able to execute arbitrary code with     the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

According to its version number, the installed version of RealPlayer / RealPlayer Enterprise on the remote Windows host suffers from possibly several issues :

  - Heap memory corruption issues in several ActiveX controls can lead to arbitrary code execution (CVE-2008-1309).
  - An unspecified local resource reference vulnerability (CVE-2008-3064).
  - An SWF file heap-based buffer overflow (CVE-2007-5400).
  - A buffer overflow involving the 'import()' method in an ActiveX control implemented by the 'rjbdll.dll' module could result in arbitrary code execution (CVE-2008-3066).

Note that RealPlayer 11 (builds 6.0.14.738 - 6.0.14.802) are only affected by the first issue (CVE-2008-1309).
Note that the vendor's advisory states that version numbers for RealPlayer 10.5 are not sequential.

According to its build number, the installed version of RealPlayer / on the remote Windows host suffers from possibly several issues :

  - Heap memory corruption issues in several ActiveX     controls can lead to arbitrary code execution.
    (CVE-2008-1309)

  - An unspecified local resource reference vulnerability.
    (CVE-2008-3064)

  - An SWF file heap-based buffer overflow. (CVE-2007-5400)

  - A buffer overflow involving the 'import()' method in an     ActiveX control implemented by the 'rjbdll.dll' module     could result in arbitrary code execution.
    (CVE-2008-3066)

Note that RealPlayer 11 (builds 6.0.14.738 - 6.0.14.802) are only affected by the first issue (CVE-2008-1309).

ID	Name	Product	Family	Type	Severity
71486	GLSA-201312-11 : Win32 Codecs: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	Local	high
51688	SuSE 10 Security Update : RealPlayer (ZYPP Patch Number 6266)	Nessus	SuSE Local Security Checks	Local	high
40726	RHEL 3 / 4 / 5 : RealPlayer (RHSA-2008:0812)	Nessus	Red Hat Local Security Checks	Local	high
39902	openSUSE Security Update : RealPlayer (RealPlayer-906)	Nessus	SuSE Local Security Checks	Local	high
38910	openSUSE 10 Security Update : RealPlayer (RealPlayer-6265)	Nessus	SuSE Local Security Checks	Local	high
34092	GLSA-200809-03 : RealPlayer: Buffer overflow	Nessus	Gentoo Local Security Checks	Local	high
4608	RealPlayer for Windows < 6.0.14.806 / 6.0.12.1675 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients		medium
33744	RealPlayer for Windows < Build 6.0.14.806 / 6.0.12.1675 Multiple Vulnerabilities	Nessus	Windows	Local	high

Detections

Analytics

CVE-2007-5400

high

Tenable Plugins

high

high

high

high

high

high

medium

high