===================================================================== CERT-Renater Note d'Information No. 2010/VULN414 _____________________________________________________________________ DATE : 18/10/2010 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running RealPlayer SP, RealPlayer Enterprise. ====================================================================== http://www.zerodayinitiative.com/advisories/ZDI-10-213/ http://www.zerodayinitiative.com/advisories/ZDI-10-212/ http://www.zerodayinitiative.com/advisories/ZDI-10-211/ http://www.zerodayinitiative.com/advisories/ZDI-10-210/ http://www.zerodayinitiative.com/advisories/ZDI-10-209/ ______________________________________________________________________ RRealNetworks RealPlayer Multiple Protocol Handlers Remote Code Execution Vulnerability ZDI-10-213: October 15th, 2010 CVE ID CVE-2010-3751 CVSS Score 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C) Affected Vendors RealNetworks Affected Products RealPlayer Vulnerability Details This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists within the RealPlayer ActiveX control. This module is responsible for handling the tfile, pnmm, cdda, protocol handlers. While parsing a long argument ending with ".smil" an attacker can overflow a buffer on the heap. This can be abused to execute arbitrary code under the context of the user invoking the control. Vendor Response RealNetworks has issued an update to correct this vulnerability. More details can be found at: http://service.real.com/realplayer/security/10152010_player/en/ Disclosure Timeline 2010-06-02 - Vulnerability reported to vendor 2010-10-15 - Coordinated public release of advisory Credit This vulnerability was discovered by: Anonymous __________________________________________________________________________ RealNetworks RealPlayer RJMDSections Remote Code Execution Vulnerability ZDI-10-212: October 15th, 2010 CVE ID CVE-2010-3750 CVSS Score 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C) Affected Vendors RealNetworks Affected Products RealPlayer TippingPoint™ IPS Customer Protection TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 10060. For further product information on the TippingPoint IPS: http://www.tippingpoint.com Vulnerability Details This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. User interaction is required in that a target must open a malicious website or media file. The specific flaw exists within the code responsible for parsing Name Value Property (NVP) elements from within logical streams in a RealPlayer media file. Specifically, a function within the rjrmrpln.dll file allocates a buffer on the heap which can be directly influenced from data within the file. This buffer is then written to using another value defined in the file and thus also controlled. By crafting a malicious media file an attacker can abuse this to execute arbitrary code under the context of the user running the player. Vendor Response RealNetworks has issued an update to correct this vulnerability. More details can be found at: http://service.real.com/realplayer/security/10152010_player/en/ Disclosure Timeline 2010-02-02 - Vulnerability reported to vendor 2010-10-15 - Coordinated public release of advisory Credit This vulnerability was discovered by: Sebastian Apelt (www.siberas.de) ________________________________________________________________________ RealNetworks Realplayer RecordClip Parameter Injection Remote Code Execution Vulnerability ZDI-10-211: October 15th, 2010 CVE ID CVE-2010-3749 CVSS Score 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C) Affected Vendors RealNetworks Affected Products RealPlayer TippingPoint™ IPS Customer Protection TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 10057. For further product information on the TippingPoint IPS: http://www.tippingpoint.com Vulnerability Details This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists within the browser plugins provided by RealNetworks. The RecordClip method can be access via the ActiveX control or the Firefox plugin. By injecting a specific character into the arguments to this method, invalid parameters can be passed to a child process that is launched on the local system. This parameter injection allows an attacker to download and subsequently execute a file on a target system, thus allowing for remote code execution. Vendor Response RealNetworks has issued an update to correct this vulnerability. More details can be found at: http://service.real.com/realplayer/security/10152010_player/en/ Disclosure Timeline 2010-01-06 - Vulnerability reported to vendor 2010-10-15 - Coordinated public release of advisory Credit This vulnerability was discovered by: Sean de Regge _________________________________________________________________________ RealNetworks RealPlayer ActiveX Control CDDA URI Uninitialized Pointer Remote Code Execution Vulnerability ZDI-10-210: October 15th, 2010 CVE ID CVE-2010-3747 CVSS Score 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C) Affected Vendors RealNetworks Affected Products RealPlayer TippingPoint™ IPS Customer Protection TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 9337. For further product information on the TippingPoint IPS: http://www.tippingpoint.com Vulnerability Details This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealPlayer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists during the parsing of long CDDA URIs due to a failure to initialize a particular component of an object. The application will later call a method in the object leading to the uninitialized pointer being called. If an attacker can place data they control at the uninitialized location, the application will call malicious pointer which can lead to code execution under the context of the application. Vendor Response RealNetworks has issued an update to correct this vulnerability. More details can be found at: http://service.real.com/realplayer/security/10152010_player/en/ Disclosure Timeline 2009-11-24 - Vulnerability reported to vendor 2010-10-15 - Coordinated public release of advisory Credit This vulnerability was discovered by: CHkr_D591 ________________________________________________________________________ RealNetworks RealPlayer Malformed IVR Pointer Index Remote Code Execution Vulnerability ZDI-10-209: October 15th, 2010 CVE ID CVE-2010-2998 CVSS Score 9, (AV:N/AC:L/Au:N/C:P/I:P/A:C) Affected Vendors RealNetworks Affected Products RealPlayer TippingPoint™ IPS Customer Protection TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 8468. For further product information on the TippingPoint IPS: http://www.tippingpoint.com Vulnerability Details This vulnerability allows attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists when parsing a RealMedia .IVR file containing malformed sample data. The application utilizes a index in this data stream for seeking into a list of objects. Due to the lack of constraints on this index, one can seek to an arbitrary object located in memory which will lead to code execution under the context of the currently logged in user. Vendor Response RealNetworks has issued an update to correct this vulnerability. More details can be found at: http://service.real.com/realplayer/security/10152010_player/en/ Disclosure Timeline 2009-08-20 - Vulnerability reported to vendor 2010-10-15 - Coordinated public release of advisory Credit This vulnerability was discovered by: Anonymous ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23 - 25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================