[Full-disclosure] [EEYEB-20050701] - RealPlayer Zipped Skin File Buffer Overflow II
Date: Thu, 10 Nov 2005 13:44:50 -0800 To: <firstname.lastname@example.org>, <email@example.com>, <firstname.lastname@example.org>, <email@example.com>
RealPlayer Zipped Skin File Buffer Overflow II
November 10, 2005
June 26, 2005
High (Code Execution)
RealPlayer 10.5 (188.8.131.520-1235)
RealOne Player v2
RealOne Player v1
eEye Digital Security has discovered a vulnerability in RealPlayer that
allows a remote attacker to reliably overwrite the heap with arbitrary
data and execute arbitrary code in the context of the user under which
the player is running.
A RealPlayer skin file (.rjs extension) can be downloaded and applied
automatically through a web browser without the user's permission. A
skin file is a bundle of graphics and a .ini file, stored together in
ZIP format. DUNZIP32.DLL, which is included with RealPlayer, is used to
extract the contents of the skin file. When RealPlayer processes a zip
file, it will allocate the field of the file but when it is copied it
will rely on real unzip content to copy. So an attacker can zip one file
that has hostile data and create a rjs file. We can change the file
length field of rjs file so when it process this zip file it will cause
a heap overflow.
Retina Network Security Scanner has been updated to identify this
RealNetworks has released a patch for this vulnerability. The patch is
available via the "Check for Update" menu item under Tools on the
RealPlayer menu bar or from http://service.real.com/realplayer/security/
This vulnerability has been assigned the following ID numbers;
OSVDB ID: 18827
CVE ID: CAN-2005-2630
Thanks to Karl Lynn and the eeye guys for helping me analyze and write
the advisory, greets to xfocus and venus-tech lab guys.
Copyright (c) 1998-2005 eEye Digital Security
Permission is hereby granted for the redistribution of this alert
electronically. It is not to be edited in any way without express
consent of eEye. If you wish to reprint the whole or any part of this
alert in any other medium excluding electronic medium, please email
alert@eEye.com for permission.
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are no warranties, implied or express, with regard to this information.
In no event shall the author be liable for any direct or indirect
damages whatsoever arising out of or in connection with the use or
spread of this information. Any use of this information is at the user's
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/