RealNetworks RealPlayer and RealOne MBC file buffer overflow
| realnetworks-mbc-bo (25411) |  High Risk |
Description:
RealNetworks RealPlayer and RealOne Player are vulnerable to a buffer overflow caused by improper bounds checking of mimio boardcast (MBC) files. A remote attacker could exploit this vulnerability by creating a malicious MBC file and hosting it on a Web site, which could allow the attacker to execute arbitrary code on the victim's system, if the victim could be persuaded to visit the malicious site.
Platforms Affected:
- Real, RealONE Player 1
- Real, RealONE Player 2
- Real, RealPlayer 10.0
- Real, RealPlayer 10.5_build_6.0.12.1040
- Real, RealPlayer 10.5_build_6.0.12.1053
- Real, RealPlayer 10.5_build_6.0.12.1056
- Real, RealPlayer 10.5_build_6.0.12.1059
- Real, RealPlayer 10.5_build_6.0.12.1069
- Real, RealPlayer 10.5_build_6.0.12.1235
- Real, RealPlayer 10.5_build_6.0.12.1348
- Real, RealPlayer 8.0 Win32
- Real, RealPlayer Enterprise
Remedy:
Refer to the RealNetworks Customer Support - Real Security Updates Web page for upgrade information. See References.
Consequences:
Gain Access
References:
- RealNetworks Customer Support - Real Security Updates Web page, RealNetworks Releases Product Updates - 03162006 at http://service.real.com/realplayer/security/03162006_player/en/.
- BID-17202: RealNetworks Multiple Products Multiple Buffer Overflow Vulnerabilities
- CVE-2006-1370: Buffer overflow in RealNetworks RealPlayer 10.5 6.0.12.1040 through 6.0.12.1348, RealPlayer 10, RealOne Player v2, RealOne Player v1, RealPlayer 8, and RealPlayer Enterprise before 20060322 allows remote attackers to have an unknown impact via a malicious Mimio boardCast (mbc) file.
- SA19358: RealNetworks Products Multiple Buffer Overflow Vulnerabilities
- SECTRACK ID: 1015810: RealPlayer Buffer Overflow in Processing Mimio Broadcast Files May Let Remote Users Execute Arbitrary Code
- US-CERT VU#451556: RealNetworks products vulnerable to buffer overflow via specially crafted MBC file
- VUPEN/ADV-2006-1057: RealNetworks Products File Handling Multiple Buffer Overflow Vulnerabilities
Reported:
Mar 22, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net