RealPlayer for Windows < Build / Multiple Vulnerabilities

high Nessus Plugin ID 33744


The remote Windows application is affected by at least one security vulnerability.


According to its build number, the installed version of RealPlayer / on the remote Windows host suffers from possibly several issues :

- Heap memory corruption issues in several ActiveX controls can lead to arbitrary code execution.

- An unspecified local resource reference vulnerability.

- An SWF file heap-based buffer overflow. (CVE-2007-5400)

- A buffer overflow involving the 'import()' method in an ActiveX control implemented by the 'rjbdll.dll' module could result in arbitrary code execution.

Note that RealPlayer 11 (builds - are only affected by the first issue (CVE-2008-1309).


Upgrade to RealPlayer 11.0.3 (build / RealPlayer 10.5 (build or later.

Note that the vendor's advisory states that build numbers for RealPlayer 10.5 are not sequential.

See Also

Plugin Details

Severity: High

ID: 33744

File Name: realplayer_6_0_14_806.nasl

Version: 1.21

Type: local

Agent: windows

Family: Windows

Published: 7/28/2008

Updated: 11/15/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information


Risk Factor: High

Score: 8.9


Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:realnetworks:realplayer

Required KB Items: SMB/RealPlayer/Product, SMB/RealPlayer/Build

Exploit Available: true

Exploit Ease: Exploits are available

Exploitable With

CANVAS (D2ExploitPack)

Core Impact

Metasploit (RealPlayer rmoc3260.dll ActiveX Control Heap Corruption)

Reference Information

CVE: CVE-2007-5400, CVE-2008-1309, CVE-2008-3064, CVE-2008-3066

BID: 28157, 30370, 30376, 30378, 30379

CWE: 119, 264, 399

Secunia: 27620, 29315