CVE-2010-4385

Related Files

RealNetworks RealPlayer SIPR Stream Frame Dimensions Remote Code Execution

Posted Dec 10, 2010

Authored by Aaron Portnoy, Logan Brown, Zef Cekaj | Site tippingpoint.com

A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. Authentication is not required to exploit this vulnerability. The specific flaw exists within the drv1.dll module. Code responsible for parsing SIPR stream metadata trusts frame width and height values from the input file. By crafting particular values an integer value used in a loop can be made to wrap negatively. The loop will subsequently overflow a static heap buffer during an inline memory copy. By crafting a malicious .rm file an attacker can exploit this vulnerability remotely using the RealPlayer ActiveX control.

tags | advisory, remote, overflow, arbitrary, activex

advisories | CVE-2010-4385

SHA-256 | 9008fd6701a36aedb79d1920596baf54f3e5c2c61a1f4933ad72ba730297ce9a

Download | Favorite | View