Stack-based buffer overflow in protocol/rtsp/rtspclnt.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.x; RealPlayer SP 1.0.0 and 1.0.1; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, 11.0, and 11.0.1; Linux RealPlayer 10, 11.0.0, and 11.0.1; and Helix Player 10.x, 11.0.0, and 11.0.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an ASM RuleBook with a large number of rules, related to an "array overflow."

GNOME 2.6.0_x86: RealPlayer media application.
Date this patch was last updated by Sun : Apr/09/10

GNOME 2.6.0: RealPlayer media application.
Date this patch was last updated by Sun : Apr/09/10

From Red Hat Security Advisory 2010:0094 :

An updated HelixPlayer package that fixes several security issues is now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

HelixPlayer is a media player.

Multiple buffer and integer overflow flaws were found in the way HelixPlayer processed Graphics Interchange Format (GIF) files. An attacker could create a specially crafted GIF file which would cause HelixPlayer to crash or, potentially, execute arbitrary code when opened. (CVE-2009-4242, CVE-2009-4245)

A buffer overflow flaw was found in the way HelixPlayer processed Synchronized Multimedia Integration Language (SMIL) files. An attacker could create a specially crafted SMIL file which would cause HelixPlayer to crash or, potentially, execute arbitrary code when opened. (CVE-2009-4257)

A buffer overflow flaw was found in the way HelixPlayer handled the Real Time Streaming Protocol (RTSP) SET_PARAMETER directive. A malicious RTSP server could use this flaw to crash HelixPlayer or, potentially, execute arbitrary code. (CVE-2009-4248)

Multiple buffer overflow flaws were discovered in the way HelixPlayer handled RuleBook structures in media files and RTSP streams. Specially crafted input could cause HelixPlayer to crash or, potentially, execute arbitrary code. (CVE-2009-4247, CVE-2010-0417)

A buffer overflow flaw was found in the way HelixPlayer performed URL un-escaping. A specially crafted URL string could cause HelixPlayer to crash or, potentially, execute arbitrary code. (CVE-2010-0416)

All HelixPlayer users are advised to upgrade to this updated package, which contains backported patches to resolve these issues. All running instances of HelixPlayer must be restarted for this update to take effect.

Multiple buffer and integer overflow flaws were found in the way HelixPlayer processed Graphics Interchange Format (GIF) files. An attacker could create a specially crafted GIF file which would cause HelixPlayer to crash or, potentially, execute arbitrary code when opened. (CVE-2009-4242, CVE-2009-4245)

A buffer overflow flaw was found in the way HelixPlayer processed Synchronized Multimedia Integration Language (SMIL) files. An attacker could create a specially crafted SMIL file which would cause HelixPlayer to crash or, potentially, execute arbitrary code when opened. (CVE-2009-4257)

A buffer overflow flaw was found in the way HelixPlayer handled the Real Time Streaming Protocol (RTSP) SET_PARAMETER directive. A malicious RTSP server could use this flaw to crash HelixPlayer or, potentially, execute arbitrary code. (CVE-2009-4248)

Multiple buffer overflow flaws were discovered in the way HelixPlayer handled RuleBook structures in media files and RTSP streams. Specially crafted input could cause HelixPlayer to crash or, potentially, execute arbitrary code. (CVE-2009-4247, CVE-2010-0417)

A buffer overflow flaw was found in the way HelixPlayer performed URL un-escaping. A specially crafted URL string could cause HelixPlayer to crash or, potentially, execute arbitrary code. (CVE-2010-0416)

All running instances of HelixPlayer must be restarted for this update to take effect.

The security support of Real Player 10 was discontinued a while ago by Real Networks.

As there are known critical security problems in Real Player 10 and we are unable to fix them nor update to Real Player 11, we are disabling this player.

The media player of SUSE Linux Enterprise Desktop 10, Helix Banshee, has been switched to use the Fluendo GSTreamer MP3 codec included in this update to keep MP3 playing abilities.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2010:0094 advisory.

  - HelixPlayer / RealPlayer: GIF file heap overflow (CVE-2009-4242)

  - HelixPlayer / RealPlayer: compressed GIF heap overflow (CVE-2009-4245)

  - HelixPlayer / RealPlayer: RTSP client ASM RuleBook stack buffer overflow (CVE-2009-4247)

  - HelixPlayer / RealPlayer: RTSP SET_PARAMETER buffer overflow (CVE-2009-4248)

  - HelixPlayer / RealPlayer: SMIL getAtom heap buffer overflow (CVE-2009-4257)

  - HelixPlayer / RealPlayer: URL unescape buffer overflow (CVE-2010-0416)

  - HelixPlayer / RealPlayer: rule book handling heap corruption (CVE-2010-0417)

  - HelixPlayer multiple flaws (CVE-2010-2997, CVE-2010-4375, CVE-2010-4378, CVE-2010-4379, CVE-2010-4382,     CVE-2010-4383, CVE-2010-4385, CVE-2010-4386, CVE-2010-4392, CVE-2010-4376) (CVE-2010-4376)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An updated HelixPlayer package that fixes several security issues is now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

HelixPlayer is a media player.

Multiple buffer and integer overflow flaws were found in the way HelixPlayer processed Graphics Interchange Format (GIF) files. An attacker could create a specially crafted GIF file which would cause HelixPlayer to crash or, potentially, execute arbitrary code when opened. (CVE-2009-4242, CVE-2009-4245)

A buffer overflow flaw was found in the way HelixPlayer processed Synchronized Multimedia Integration Language (SMIL) files. An attacker could create a specially crafted SMIL file which would cause HelixPlayer to crash or, potentially, execute arbitrary code when opened. (CVE-2009-4257)

A buffer overflow flaw was found in the way HelixPlayer handled the Real Time Streaming Protocol (RTSP) SET_PARAMETER directive. A malicious RTSP server could use this flaw to crash HelixPlayer or, potentially, execute arbitrary code. (CVE-2009-4248)

Multiple buffer overflow flaws were discovered in the way HelixPlayer handled RuleBook structures in media files and RTSP streams. Specially crafted input could cause HelixPlayer to crash or, potentially, execute arbitrary code. (CVE-2009-4247, CVE-2010-0417)

A buffer overflow flaw was found in the way HelixPlayer performed URL un-escaping. A specially crafted URL string could cause HelixPlayer to crash or, potentially, execute arbitrary code. (CVE-2010-0416)

All HelixPlayer users are advised to upgrade to this updated package, which contains backported patches to resolve these issues. All running instances of HelixPlayer must be restarted for this update to take effect.

The remote host is running a version of RealPlayer earlier than RealPlayer SP 1.0.5.  Such versions are potentially affected by multiple vulnerabilities :

  - A RealPlayer 'ASM' Rulebook heap-based buffer overflow. (CVE-2009-4241)

  - A RealPlayer 'GIF' file heap overflow. (CVE-2009-4242)

  - A RealPlayer media overflow (http chunck encoding). (CVE-2009-4243)

  - A RealPlayer 'IVR' file processing buffer overflow. (CVE-2009-0375)

  - A RealPlayer 'IVR' file heap overflow. (CVE-2009-0376)

  - A RealPlayer 'SIPR' codec heap overflow. (CVE-2009-4244)

  - A RealPlayer compressed 'GIF' heap overflow. (CVE-2009-4245)

  - A RealPlayer 'SMIL' parsing heap overflow. (CVE-2009-4257)

  - A RealPlayer skin parsing stack overflow. (CVE-2009-4246)

  - A RealPlayer 'ASM' RuleBook array overflow. (CVE-2009-4247)

  - A RealPlayer 'rtsp' 'set_parameter' buffer overflow. (CVE-2009-4248)

Note that different versions are affected by different vulnerabilities.

According to its build number, the installed version of RealPlayer on the remote Windows host has multiple buffer overflow vulnerabilities :

  - A RealPlayer 'ASM' Rulebook heap-based overflow.     (CVE-2009-4241)

  - A RealPlayer 'GIF' file heap overflow. (CVE-2009-4242)

  - A RealPlayer media overflow ('http' chunk encoding).
    (CVE-2009-4243)

  - A RealPlayer 'IVR' file processing buffer overflow.
    (CVE-2009-0375)

  - A RealPlayer 'IVR' file heap overflow. (CVE-2009-0376)

  - A RealPlayer 'SIPR' codec heap overflow. (CVE-2009-4244)

  - A RealPlayer compressed 'GIF' heap overflow.     (CVE-2009-4245)

  - A RealPlayer 'SMIL' parsing heap overflow.     (CVE-2009-4257)

  - A RealPlayer skin parsing stack overflow.     (CVE-2009-4246)

  - A RealPlayer 'ASM' RuleBook Array Overflow.     (CVE-2009-4247)

  - A RealPlayer 'rtsp' set_parameter buffer overflow.
    (CVE-2009-4248)

ID	Name	Product	Family	Severity
107889	Solaris 10 (x86) : 122959-06	Nessus	Solaris Local Security Checks	high
107387	Solaris 10 (sparc) : 122958-06	Nessus	Solaris Local Security Checks	high
67994	Oracle Linux 4 : HelixPlayer (ELSA-2010-0094)	Nessus	Oracle Linux Local Security Checks	high
60729	Scientific Linux Security Update : HelixPlayer on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
51689	SuSE 10 Security Update : Realplayer and banshee (ZYPP Patch Number 7122)	Nessus	SuSE Local Security Checks	high
44430	RHEL 4 : HelixPlayer (RHSA-2010:0094)	Nessus	Red Hat Local Security Checks	high
44428	CentOS 4 : HelixPlayer (CESA-2010:0094)	Nessus	CentOS Local Security Checks	high
5325	Real Networks RealPlayer < RealPlayer SP 1.0.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
44119	RealPlayer for Windows < Build 12.0.0.319 Multiple Buffer Overflows	Nessus	Windows	high

Detections

Analytics

CVE-2009-4247

critical

Tenable Plugins

high

high

high

high

high

high

high

medium

high