Test ID:	1.3.6.1.4.1.25623.1.0.902105
Category:	Buffer overflow
Title:	RealNetworks RealPlayer Multiple Code Execution Vulnerabilities (Windows)
Summary:	This host is installed with RealPlayer which is prone to multiple code; execution vulnerabilities.
Description:	Summary: This host is installed with RealPlayer which is prone to multiple code execution vulnerabilities. Vulnerability Insight: Buffer overflow errors exist, when processing a malformed 'ASM Rulebook', 'GIF file', 'media file', 'IVR file', 'SIPR Codec', 'SMIL file', 'Skin', and 'set_parameter' method. Vulnerability Impact: Successful exploitation will let the attacker execute arbitrary code within the context of the application and can cause a heap overflow or allow remote code execution. Affected Software/OS: RealPlayer versions before 10.5(6.0.12.1741) and RealPlayer versions 11.0.0 through 11.0.4 on Windows platforms. Solution: Upgrade to RealPlayer version 10.5(6.0.12.1741) or 11.0.5 CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	BugTraq ID: 33652 BugTraq ID: 37880 Common Vulnerability Exposure (CVE) ID: CVE-2009-0375 http://www.securityfocus.com/bid/33652 Bugtraq: 20090206 RealNetworks RealPlayer IVR File Processing Multiple Code Execute Vulnerabilities (Google Search) http://www.securityfocus.com/archive/1/500722/100/0/threaded http://www.fortiguardcenter.com/advisory/FGA-2009-04.html http://secunia.com/advisories/33810 http://secunia.com/advisories/38218 http://www.vupen.com/english/advisories/2010/0178 XForce ISS Database: realplayer-ivr-bo(48567) https://exchange.xforce.ibmcloud.com/vulnerabilities/48567 Common Vulnerability Exposure (CVE) ID: CVE-2009-0376 Bugtraq: 20100121 ZDI-10-009: RealNetworks RealPlayer IVR Format Remote Code Execution Vulnerability (Google Search) http://www.securityfocus.com/archive/1/509097/100/0/threaded http://www.zerodayinitiative.com/advisories/ZDI-10-009/ XForce ISS Database: realplayer-ivr-code-execution(48568) https://exchange.xforce.ibmcloud.com/vulnerabilities/48568 Common Vulnerability Exposure (CVE) ID: CVE-2009-4241 http://www.securityfocus.com/bid/37880 Bugtraq: 20100121 ZDI-10-005: RealNetworks RealPlayer ASMRulebook Remote Code Execution Vulnerability (Google Search) http://www.securityfocus.com/archive/1/509100/100/0/threaded http://www.zerodayinitiative.com/advisories/ZDI-10-005/ http://securitytracker.com/id?1023489 XForce ISS Database: realplayer-asmrulebook-bo(55794) https://exchange.xforce.ibmcloud.com/vulnerabilities/55794 Common Vulnerability Exposure (CVE) ID: CVE-2009-4242 Bugtraq: 20100121 ZDI-10-006: RealNetworks RealPlayer GIF Handling Remote Code Execution Vulnerability (Google Search) http://www.securityfocus.com/archive/1/509096/100/0/threaded http://www.zerodayinitiative.com/advisories/ZDI-10-006/ http://lists.helixcommunity.org/pipermail/datatype-cvs/2008-September/008633.html http://osvdb.org/61966 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10144 http://www.redhat.com/support/errata/RHSA-2010-0094.html http://secunia.com/advisories/38450 XForce ISS Database: realplayer-gif-bo(55795) https://exchange.xforce.ibmcloud.com/vulnerabilities/55795 Common Vulnerability Exposure (CVE) ID: CVE-2009-4243 http://osvdb.org/61967 XForce ISS Database: realplayer-httpchunk-bo(55796) https://exchange.xforce.ibmcloud.com/vulnerabilities/55796 Common Vulnerability Exposure (CVE) ID: CVE-2009-4244 Bugtraq: 20100121 ZDI-10-008: RealNetworks RealPlayer SIPR Codec Remote Code Execution Vulnerability (Google Search) http://www.securityfocus.com/archive/1/509098/100/0/threaded http://www.zerodayinitiative.com/advisories/ZDI-10-008/ XForce ISS Database: realplayer-sipr-bo(55797) https://exchange.xforce.ibmcloud.com/vulnerabilities/55797 Common Vulnerability Exposure (CVE) ID: CVE-2009-4245 http://lists.helixcommunity.org/pipermail/datatype-cvs/2008-July/008455.html http://osvdb.org/61969 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9998 XForce ISS Database: realplayer-gifimage-bo(55800) https://exchange.xforce.ibmcloud.com/vulnerabilities/55800 Common Vulnerability Exposure (CVE) ID: CVE-2009-4246 Bugtraq: 20100121 ZDI-10-010: RealNetworks RealPlayer Skin Parsing Remote Code Execution Vulnerability (Google Search) http://www.securityfocus.com/archive/1/509104/100/0/threaded http://www.zerodayinitiative.com/advisories/ZDI-10-010/ XForce ISS Database: realplayer-skin-bo(55799) https://exchange.xforce.ibmcloud.com/vulnerabilities/55799 Common Vulnerability Exposure (CVE) ID: CVE-2009-4247 http://lists.helixcommunity.org/pipermail/helix-client-dev/2009-August/008092.html http://lists.helixcommunity.org/pipermail/protocol-cvs/2009-August/001943.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10677 XForce ISS Database: realplayer-rulebook-overflow(55802) https://exchange.xforce.ibmcloud.com/vulnerabilities/55802 Common Vulnerability Exposure (CVE) ID: CVE-2009-4248 http://lists.helixcommunity.org/pipermail/client-cvs/2008-January/003756.html http://lists.helixcommunity.org/pipermail/client-cvs/2008-January/003759.html http://lists.helixcommunity.org/pipermail/client-dev/2008-January/004591.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10641 XForce ISS Database: realplayer-rtsp-setparameter-bo(55801) https://exchange.xforce.ibmcloud.com/vulnerabilities/55801 Common Vulnerability Exposure (CVE) ID: CVE-2009-4257 Bugtraq: 20100121 ZDI-10-007: RealNetworks RealPlayer SMIL getAtom Remote Code Execution Vulnerability (Google Search) http://www.securityfocus.com/archive/1/509105/100/0/threaded http://www.zerodayinitiative.com/advisories/ZDI-10-007/ http://lists.helixcommunity.org/pipermail/datatype-cvs/2008-September/008678.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11110 XForce ISS Database: realnetworks-realplayer-smil-bo(55798) https://exchange.xforce.ibmcloud.com/vulnerabilities/55798
Copyright	Copyright (C) 2010 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.