ID de Prueba:	1.3.6.1.4.1.25623.1.0.902105
Categoría:	Buffer overflow
Título:	RealNetworks RealPlayer Multiple Code Execution Vulnerabilities - Windows
Resumen:	RealPlayer is prone to multiple code execution vulnerabilities.
Descripción:	Summary: RealPlayer is prone to multiple code execution vulnerabilities. Vulnerability Insight: Buffer overflow errors exist, when processing a malformed 'ASM Rulebook', 'GIF file', 'media file', 'IVR file', 'SIPR Codec', 'SMIL file', 'Skin', and 'set_parameter' method. Vulnerability Impact: Successful exploitation will let the attacker execute arbitrary code within the context of the application and can cause a heap overflow or allow remote code execution. Affected Software/OS: RealPlayer versions before 10.5(6.0.12.1741) and RealPlayer versions 11.0.0 through 11.0.4 on Windows platforms. Solution: Upgrade to RealPlayer version 10.5(6.0.12.1741) or 11.0.5 CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2009-0375 BugTraq ID: 33652 http://www.securityfocus.com/bid/33652 Bugtraq: 20090206 RealNetworks RealPlayer IVR File Processing Multiple Code Execute Vulnerabilities (Google Search) http://www.securityfocus.com/archive/1/500722/100/0/threaded http://www.fortiguardcenter.com/advisory/FGA-2009-04.html http://secunia.com/advisories/33810 http://secunia.com/advisories/38218 http://www.vupen.com/english/advisories/2010/0178 XForce ISS Database: realplayer-ivr-bo(48567) https://exchange.xforce.ibmcloud.com/vulnerabilities/48567 Common Vulnerability Exposure (CVE) ID: CVE-2009-0376 Bugtraq: 20100121 ZDI-10-009: RealNetworks RealPlayer IVR Format Remote Code Execution Vulnerability (Google Search) http://www.securityfocus.com/archive/1/509097/100/0/threaded http://www.zerodayinitiative.com/advisories/ZDI-10-009/ XForce ISS Database: realplayer-ivr-code-execution(48568) https://exchange.xforce.ibmcloud.com/vulnerabilities/48568 Common Vulnerability Exposure (CVE) ID: CVE-2009-4241 BugTraq ID: 37880 http://www.securityfocus.com/bid/37880 Bugtraq: 20100121 ZDI-10-005: RealNetworks RealPlayer ASMRulebook Remote Code Execution Vulnerability (Google Search) http://www.securityfocus.com/archive/1/509100/100/0/threaded http://www.zerodayinitiative.com/advisories/ZDI-10-005/ http://securitytracker.com/id?1023489 XForce ISS Database: realplayer-asmrulebook-bo(55794) https://exchange.xforce.ibmcloud.com/vulnerabilities/55794 Common Vulnerability Exposure (CVE) ID: CVE-2009-4242 Bugtraq: 20100121 ZDI-10-006: RealNetworks RealPlayer GIF Handling Remote Code Execution Vulnerability (Google Search) http://www.securityfocus.com/archive/1/509096/100/0/threaded http://www.zerodayinitiative.com/advisories/ZDI-10-006/ http://lists.helixcommunity.org/pipermail/datatype-cvs/2008-September/008633.html http://osvdb.org/61966 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10144 http://www.redhat.com/support/errata/RHSA-2010-0094.html http://secunia.com/advisories/38450 XForce ISS Database: realplayer-gif-bo(55795) https://exchange.xforce.ibmcloud.com/vulnerabilities/55795 Common Vulnerability Exposure (CVE) ID: CVE-2009-4243 http://osvdb.org/61967 XForce ISS Database: realplayer-httpchunk-bo(55796) https://exchange.xforce.ibmcloud.com/vulnerabilities/55796 Common Vulnerability Exposure (CVE) ID: CVE-2009-4244 Bugtraq: 20100121 ZDI-10-008: RealNetworks RealPlayer SIPR Codec Remote Code Execution Vulnerability (Google Search) http://www.securityfocus.com/archive/1/509098/100/0/threaded http://www.zerodayinitiative.com/advisories/ZDI-10-008/ XForce ISS Database: realplayer-sipr-bo(55797) https://exchange.xforce.ibmcloud.com/vulnerabilities/55797 Common Vulnerability Exposure (CVE) ID: CVE-2009-4245 http://lists.helixcommunity.org/pipermail/datatype-cvs/2008-July/008455.html http://osvdb.org/61969 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9998 XForce ISS Database: realplayer-gifimage-bo(55800) https://exchange.xforce.ibmcloud.com/vulnerabilities/55800 Common Vulnerability Exposure (CVE) ID: CVE-2009-4246 Bugtraq: 20100121 ZDI-10-010: RealNetworks RealPlayer Skin Parsing Remote Code Execution Vulnerability (Google Search) http://www.securityfocus.com/archive/1/509104/100/0/threaded http://www.zerodayinitiative.com/advisories/ZDI-10-010/ XForce ISS Database: realplayer-skin-bo(55799) https://exchange.xforce.ibmcloud.com/vulnerabilities/55799 Common Vulnerability Exposure (CVE) ID: CVE-2009-4247 http://lists.helixcommunity.org/pipermail/helix-client-dev/2009-August/008092.html http://lists.helixcommunity.org/pipermail/protocol-cvs/2009-August/001943.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10677 XForce ISS Database: realplayer-rulebook-overflow(55802) https://exchange.xforce.ibmcloud.com/vulnerabilities/55802 Common Vulnerability Exposure (CVE) ID: CVE-2009-4248 http://lists.helixcommunity.org/pipermail/client-cvs/2008-January/003756.html http://lists.helixcommunity.org/pipermail/client-cvs/2008-January/003759.html http://lists.helixcommunity.org/pipermail/client-dev/2008-January/004591.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10641 XForce ISS Database: realplayer-rtsp-setparameter-bo(55801) https://exchange.xforce.ibmcloud.com/vulnerabilities/55801 Common Vulnerability Exposure (CVE) ID: CVE-2009-4257 Bugtraq: 20100121 ZDI-10-007: RealNetworks RealPlayer SMIL getAtom Remote Code Execution Vulnerability (Google Search) http://www.securityfocus.com/archive/1/509105/100/0/threaded http://www.zerodayinitiative.com/advisories/ZDI-10-007/ http://lists.helixcommunity.org/pipermail/datatype-cvs/2008-September/008678.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11110 XForce ISS Database: realnetworks-realplayer-smil-bo(55798) https://exchange.xforce.ibmcloud.com/vulnerabilities/55798
Copyright	Copyright (C) 2010 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.