Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

RealPlayer 18.1.5.x < 18.1.5.694 (Win) RCE

High

Synopsis

The remote host is running a version of RealPlayer multimedia application that may be vulnerable to a Remote Code Execution (RCE) attack vector.

Description

Versions of RealPlayer 18.1.5.x prior to 18.1.5.694 on Windows are potentially affected by a flaw that is triggered when loading certain dynamic-link libraries. The program uses an insecure path to look for specific files or libraries that includes the current working directory, which may not be trusted or under user control. By placing a specially crafted library in the path, a local attacker can inject and execute arbitrary code with the privilege of the user running the program.

Solution

Windows users should upgrade to RealPlayer 18.1.5.694 or later.