[NT] RealPlayer Zipped Skin File Buffer Overflow

From: SecuriTeam (support_at_securiteam.com)
Date: 10/28/04 

To: list@securiteam.com
Date: 28 Oct 2004 14:35:09 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  RealPlayer Zipped Skin File Buffer Overflow
------------------------------------------------------------------------

SUMMARY

eEye Digital Security has discovered a vulnerability in RealPlayer that
allows a remote attacker to reliably overwrite the stack with arbitrary
data and execute arbitrary code in the context of the user under which the
player is running.

DETAILS

Vulnerable Systems:
 * RealPlayer 10.5 (6.0.12.1053 and earlier)
 * RealPlayer 10
 * RealOne Player v2
 * RealOne Player v1

A RealPlayer skin file (.rjs extension) can be downloaded and applied
automatically through a web browser without the user's permission. A skin
file is a bundle of graphics and a .ini file, stored together in ZIP
format. DUNZIP32.DLL, which is included with RealPlayer, is used to
extract the contents of the skin file. When an .rjs file containing a long
file name (greater than around 0x8000 bytes) is opened, either in
RealPlayer or through a web browser, a stack based buffer overflow occurs,
allowing an exception handler record to be overwritten and EIP to be
hijacked.

Vendor Status:
RealNetworks has released a patch for this vulnerability. The patch is
available via the "Check for Update" menu item under Tools on the
RealPlayer menu bar. "Security Update - Skin File Overflow" Recommended
Player Update: Resolves a security vulnerability when activating a
specifically malformed skins file. Skins files available on RealNetworks
site are examined before being posted. Skins files from other sources
should be treated with caution.

ADDITIONAL INFORMATION

The information has been provided by <mailto:mmaiffret@eeye.com> Marc
Maiffret.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages