Real Networks RealPlayer < RealPlayer SP 1.0.5 Multiple Vulnerabilities

medium Nessus Network Monitor Plugin ID 5325

Synopsis

The remote host is running an application that is vulnerable to multiple attack vectors.

Description

The remote host is running a version of RealPlayer earlier than RealPlayer SP 1.0.5. Such versions are potentially affected by multiple vulnerabilities :

- A RealPlayer 'ASM' Rulebook heap-based buffer overflow. (CVE-2009-4241)

- A RealPlayer 'GIF' file heap overflow. (CVE-2009-4242)

- A RealPlayer media overflow (http chunck encoding). (CVE-2009-4243)

- A RealPlayer 'IVR' file processing buffer overflow. (CVE-2009-0375)

- A RealPlayer 'IVR' file heap overflow. (CVE-2009-0376)

- A RealPlayer 'SIPR' codec heap overflow. (CVE-2009-4244)

- A RealPlayer compressed 'GIF' heap overflow. (CVE-2009-4245)

- A RealPlayer 'SMIL' parsing heap overflow. (CVE-2009-4257)

- A RealPlayer skin parsing stack overflow. (CVE-2009-4246)

- A RealPlayer 'ASM' RuleBook array overflow. (CVE-2009-4247)

- A RealPlayer 'rtsp' 'set_parameter' buffer overflow. (CVE-2009-4248)

Note that different versions are affected by different vulnerabilities.

Solution

Upgrade to RealPlayer SP 1.0.5 or later.

See Also

http://www.securityfocus.com/archive/1/509100/30/0/threaded

http://www.securityfocus.com/archive/1/509096/30/0/threaded

http://www.securityfocus.com/archive/1/509105/30/0/threaded

http://www.securityfocus.com/archive/1/509098/30/0/threaded

http://www.securityfocus.com/archive/1/509104/30/0/threaded

http://www.zerodayinitiative.com/advisories/ZDI-10-005

http://www.zerodayinitiative.com/advisories/ZDI-10-006

http://www.zerodayinitiative.com/advisories/ZDI-10-007

http://www.zerodayinitiative.com/advisories/ZDI-10-008

http://www.zerodayinitiative.com/advisories/ZDI-10-010

http://service.real.com/realplayer/security/01192010_player/en

Plugin Details

Severity: Medium

ID: 5325

Family: Web Clients

Published: 1/22/2010

Updated: 3/6/2019

Nessus ID: 44119

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: Medium

Base Score: 5.6

Temporal Score: 5.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:realnetworks:realplayer

Patch Publication Date: 1/19/2010

Vulnerability Publication Date: 1/19/2010

Reference Information

CVE: CVE-2009-0375, CVE-2009-0376, CVE-2009-4241, CVE-2009-4242, CVE-2009-4243, CVE-2009-4244, CVE-2009-4245, CVE-2009-4246, CVE-2009-4247, CVE-2009-4248, CVE-2009-4257

BID: 37880, 33652