RealPlayer for Windows <= 17.0.8.22 MP4 Multiple Memory Corruptions

This script is Copyright (C) 2014-2016 Tenable Network Security, Inc.


Synopsis :

A multimedia application on the remote Windows host is affected by
multiple memory corruption vulnerabilities.

Description :

According to its build number, the installed version of RealPlayer on
the remote Windows host is prior to or equal to 17.0.8.22. It is,
therefore, affected by multiple memory corruption vulnerabilities.
These vulnerabilities allow remote attackers to execute arbitrary code
within the context of the running application via a malformed 'elst'
or 'stsz' atom in a specially crafted MP4 file.

See also :

http://service.real.com/realplayer/security/06272014_player/en/
http://www.nessus.org/u?c4b56f7b

Solution :

Upgrade to RealPlayer 17.0.10.8 or later.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 7.3
(CVSS2#E:POC/RL:OF/RC:C)
Public Exploit Available : true

Family: Windows

Nessus Plugin ID: 76458 ()

Bugtraq ID: 68442

CVE ID: CVE-2014-3113

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now