[VulnWatch] iDEFENSE Security Advisory 03.01.05: RealNetworks RealPlayer .smil Buffer Overflow Vulnerability

From: Michael Sutton (msutton_at_iDefense.com)
Date: 03/01/05

  • Next message: Mark Litchfield: "[VulnWatch] RealOne Player / Real .WAV Heap Overflow File Format Vulnerability" 
    Date: Tue, 1 Mar 2005 16:17:45 -0500
To: <bugtraq@securityfocus.com>, <vulnwatch@vulnwatch.org>

    RealNetworks RealPlayer .smil Buffer Overflow Vulnerability

    iDEFENSE Security Advisory 03.01.05
    www.idefense.com/application/poi/display?id=209&type=vulnerabilities
    March 1, 2005

    I. BACKGROUND

    RealPlayer is an application for playing various media formats,
    developed by RealNetworks Inc. For more information, visit
    http://www.real.com/.

    II. DESCRIPTION

    Remote exploitation of a stack-based buffer overflow vulnerability in
    the The Synchronized Multimedia Integration Language (smil) file format
    parser within various versions of RealNetworks Inc.'s RealPlayer could
    allow attackers to execute arbitrary code.

    The vulnerability specifically exists due to an unbounded string copying
    operation. The vulnerable code is shown below:

    datatype/smil/renderer/smil1/smlparse.cpp
    CSmil1Parser::testAttributeFailed(SMIL1Node* pNode)
    line 2878
    ***
         if(HXR_OK == rc)
            {
                UINT32 ulScreenHeight = 0;
                UINT32 ulScreenWidth = 0;

                const char* pScreenSize = (const char*)pBuf->GetBuffer();
                // format is screen-height "X" screen-width
                char tmp[256]; /* Flawfinder: ignore */
                strcpy(tmp, pScreenSize); /* Flawfinder: ignore */
    ***

    The pBuf object's datapointer (which is what GetBuffer uses internally)
    is pointing at the screen-size attribute in the user-supplied smil file.
    This allows a fixed stack buffer to be overwritten with user-supplied
    data. An attacker could use this stack overwrite to manipulate a saved
    return address or Structured Exception Handler, allowing for arbitrary
    code execution.

    In order to trigger this vulnerability, one would need an otherwise
    valid .smil file with the following line added in an appropriate
    section: <text src="1024_768.en.txt" region="size" system-screen-
    size="LONGSTRINGX768">

    Note that "LONGSTRING" should be more than 256 bytes in order to cause
    stack corruption.

    III. ANALYSIS

    Exploitation allows for arbitrary code execution as the user who opened
    the .smil file.

    Exploitation requires an attacker to craft a malicious .smil and
    convince a user to open it. An attacker could also force a web browser
    to refresh and automatically load the .smil file from a normal web page
    under the attacker's control. In default installations of RealPlayer
    under Windows, Internet Explorer will not prompt the user for an action
    when encountering a .smil file. It will open it without delay, thus
    allowing a more effective method of exploitation.

    IV. DETECTION

    iDEFENSE Labs has confirmed that Real Networks Inc.'s RealPlayer 10.5
    (6.0.12.1056) on Windows and RealPlayer 10 (10.0.1.436) on Linux are
    vulnerable.

    The vendor has reported that the following products are vulnerable on
    the following platforms:

    Windows:
            RealPlayer 10.5 (6.0.12.1056 and below)
            RealPlayer 10
            RealOne Player V2
            RealOne Player V1
            RealPlayer 8
            RealPlayer Enterprise

    Mac
            RealPlayer 10 (10.0.0.325 and below)
            RealOne Player

    Linux
            RealPlayer 10
            Helix Player

    V. WORKAROUND

    There are no known workarounds for this vulnerability. Although .smil
    files can be disassociated from RealPlayer, it is still possible to
    cause these files to load with RealPlayer using other methods. One such
    method is loading the file via one of the many ActiveX Controls that
    RealPlayer contains. Any effective workaround would prevent RealPlayer
    from functioning.

    VI. VENDOR RESPONSE

    A vendor advisory for this issue is available at:

       http://service.real.com/help/faq/security/050224_player

    VII. CVE INFORMATION

    The Common Vulnerabilities and Exposures (CVE) project has assigned the
    names CAN-2005-0455 to these issues. This is a candidate for inclusion
    in the CVE list (http://cve.mitre.org), which standardizes names for
    security problems.

    VIII. DISCLOSURE TIMELINE

    01/14/2005 Initial vendor notification
    01/19/2005 Initial vendor response
    03/01/2005 Coordinated public disclosure

    IX. CREDIT

    The discoverer of this vulnerability wishes to remain anonymous.

    Get paid for vulnerability research
    http://www.idefense.com/poi/teams/vcp.jsp

    Free tools, research and upcoming events
    http://labs.idefense.com

    X. LEGAL NOTICES

    Copyright (c) 2005 iDEFENSE, Inc.

    Permission is granted for the redistribution of this alert
    electronically. It may not be edited in any way without the express
    written consent of iDEFENSE. If you wish to reprint the whole or any
    part of this alert in any other medium other than electronically, please
    email customerservice@idefense.com for permission.

    Disclaimer: The information in the advisory is believed to be accurate
    at the time of publishing based on currently available information. Use
    of the information constitutes acceptance for use in an AS IS condition.
    There are no warranties with regard to this information. Neither the
    author nor the publisher accepts any liability for any direct, indirect,
    or consequential loss or damage arising from use of, or reliance on,
    this information.

  • Next message: Mark Litchfield: "[VulnWatch] RealOne Player / Real .WAV Heap Overflow File Format Vulnerability"

    Relevant Pages