[Full-disclosure] [EEYEB-20050701] - RealPlayer Zipped Skin File Buffer Overflow II

Date: 11/10/05

  • Next message: VTLinux_at_coldrain.net: "Re: WAS: Re: [Full-disclosure] RE: Spamcop automated reporting script..."
    Date: Thu, 10 Nov 2005 13:44:50 -0800
    To: <bugtraq@securityfocus.com>, <vulnwatch@vulnwatch.org>, <ntbugtraq@ntbugtraq.com>, <full-disclosure@lists.grok.org.uk>

    RealPlayer Zipped Skin File Buffer Overflow II

    Release Date:
    November 10, 2005

    Date Reported:
    June 26, 2005

    High (Code Execution)


    Systems Affected:
    RealPlayer 10.5 (
    RealPlayer 10
    RealOne Player v2
    RealOne Player v1
    RealPlayer 8

    eEye Digital Security has discovered a vulnerability in RealPlayer that
    allows a remote attacker to reliably overwrite the heap with arbitrary
    data and execute arbitrary code in the context of the user under which
    the player is running.

    Technical Details:
    A RealPlayer skin file (.rjs extension) can be downloaded and applied
    automatically through a web browser without the user's permission. A
    skin file is a bundle of graphics and a .ini file, stored together in
    ZIP format. DUNZIP32.DLL, which is included with RealPlayer, is used to
    extract the contents of the skin file. When RealPlayer processes a zip
    file, it will allocate the field of the file but when it is copied it
    will rely on real unzip content to copy. So an attacker can zip one file
    that has hostile data and create a rjs file. We can change the file
    length field of rjs file so when it process this zip file it will cause
    a heap overflow.

    Retina Network Security Scanner has been updated to identify this

    Vendor Status:
    RealNetworks has released a patch for this vulnerability. The patch is
    available via the "Check for Update" menu item under Tools on the
    RealPlayer menu bar or from http://service.real.com/realplayer/security/

    Fang Xing

    Related Links:
    This vulnerability has been assigned the following ID numbers;

    OSVDB ID: 18827
    CVE ID: CAN-2005-2630

    Thanks to Karl Lynn and the eeye guys for helping me analyze and write
    the advisory, greets to xfocus and venus-tech lab guys.

    Copyright (c) 1998-2005 eEye Digital Security
    Permission is hereby granted for the redistribution of this alert
    electronically. It is not to be edited in any way without express
    consent of eEye. If you wish to reprint the whole or any part of this
    alert in any other medium excluding electronic medium, please email
    alert@eEye.com for permission.

    The information within this paper may change without notice. Use of this
    information constitutes acceptance for use in an AS IS condition. There
    are no warranties, implied or express, with regard to this information.
    In no event shall the author be liable for any direct or indirect
    damages whatsoever arising out of or in connection with the use or
    spread of this information. Any use of this information is at the user's
    own risk.

    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: VTLinux_at_coldrain.net: "Re: WAS: Re: [Full-disclosure] RE: Spamcop automated reporting script..."