9.3 - GLSA-200709-05

Executive Summary

Summary
Title	RealPlayer: Buffer overflow

Informations
Name	GLSA-200709-05	First vendor Publication	2007-09-14
Vendor	Gentoo	Last vendor Modification	2007-09-14
Severity (Vendor)	Normal	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

RealPlayer is vulnerable to a buffer overflow allowing for execution of arbitrary code.

Background

RealPlayer is a multimedia player capable of handling multiple multimedia file formats.

Description

A stack-based buffer overflow vulnerability has been reported in the SmilTimeValue::parseWallClockValue() function in smlprstime.cpp when handling HH:mm:ss.f type time formats.

Impact

By enticing a user to open a specially crafted SMIL (Synchronized Multimedia Integration Language) file, an attacker could be able to execute arbitrary code with the privileges of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

All RealPlayer users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-video/realplayer-10.0.9"

References

[ 1 ] CVE-2007-3410 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3410

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200709-05.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-200709-05.xml

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10554

Oval ID:	oval:org.mitre.oval:def:10554
Title:	Stack-based buffer overflow in the SmilTimeValue::parseWallClockValue function in smlprstime.cpp in RealNetworks RealPlayer 10, 10.1, and possibly 10.5, RealOne Player, RealPlayer Enterprise, and Helix Player 10.5-GOLD and 10.0.5 through 10.0.8, allows remote attackers to execute arbitrary code via an SMIL (SMIL2) file with a long wallclock value.
Description:	Stack-based buffer overflow in the SmilTimeValue::parseWallClockValue function in smlprstime.cpp in RealNetworks RealPlayer 10, 10.1, and possibly 10.5, RealOne Player, RealPlayer Enterprise, and Helix Player 10.5-GOLD and 10.0.5 through 10.0.8, allows remote attackers to execute arbitrary code via an SMIL (SMIL2) file with a long wallclock value.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-3410	Version:	3
Platform(s):	Red Hat Enterprise Linux 4 Red Hat Enterprise Linux Extras 3 Red Hat Enterprise Linux Extras 4 Red Hat Enterprise Linux Extras 5	Product(s):
Definition Synopsis:
IF The operating system installed on the system is Red Hat Enterprise Linux 4 AND HelixPlayer is earlier than 1:1.0.6-0.EL4.2.0.2 OR redhat-release is version 3 AND realplayer is earlier than 0:10.0.9-0.rhel3.4 OR redhat-release is version 4 AND RealPlayer is earlier than 0:10.0.9-2 OR redhat-release is version 5 AND RealPlayer is earlier than 0:10.0.9-3.el5

CPE : Common Platform Enumeration

Type	Description	Count
Application	Realnetworks Helix Player cpe:2.3:a:realnetworks:helix_player:10.5-gold:::::::* cpe:2.3:a:realnetworks:helix_player:10.0.8:::::::* cpe:2.3:a:realnetworks:helix_player:10.0.7:::::::* cpe:2.3:a:realnetworks:helix_player:10.0.6:::::::* cpe:2.3:a:realnetworks:helix_player:10.0.5:::::::*	5
Application	Realnetworks Realone Player cpe:2.3:a:realnetworks:realone_player::::::::	1
Application	Realnetworks Realplayer cpe:2.3:a:realnetworks:realplayer:10.5:::::::* cpe:2.3:a:realnetworks:realplayer:10.1:::::::* cpe:2.3:a:realnetworks:realplayer:10.0:::::::*	3
Application	Realnetworks Realplayer Enterprise cpe:2.3:a:realnetworks:realplayer_enterprise::::::::	1

SAINT Exploits

Description	Link
RealPlayer SMIL file wallclock buffer overflow	More info here

OpenVAS Exploits

Date	Description
2009-02-27	Name : Fedora Update for HelixPlayer FEDORA-2007-0756 File : nvt/gb_fedora_2007_0756_HelixPlayer_fc7.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200709-05 (realplayer) File : nvt/glsa_200709_05.nasl
2008-09-04	Name : FreeBSD Ports: linux-realplayer File : nvt/freebsd_linux-realplayer4.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
38342	RealPlayer smlprstime.cpp SmilTimeValue::parseWallClockValue Function SMIL Fi...
37374	RealPlayer/Helix Player smlprstime.cpp SmilTimeValue::parseWallClockValue Fun...

Information Assurance Vulnerability Management (IAVM)

Date	Description
2007-11-07	IAVM : 2007-B-0035 - Multiple RealPlayer Remote Code Execution Vulnerabilities Severity : Category II - VMSKEY : V0015376

Snort® IPS/IDS

Date	Description
2014-01-10	RealPlayer RMOC3260.DLL ActiveX function call unicode access RuleID : 12769 - Revision : 8 - Type : WEB-ACTIVEX
2014-01-10	RealNetworks RealPlayer RMOC3260.DLL ActiveX function call access RuleID : 12768 - Revision : 13 - Type : BROWSER-PLUGINS
2014-01-10	RealNetworks RealPlayer RMOC3260.DLL ActiveX function call access RuleID : 12767 - Revision : 17 - Type : BROWSER-PLUGINS
2014-01-10	RealNetworks RealPlayer RMOC3260.DLL ActiveX clsid access RuleID : 12766 - Revision : 18 - Type : BROWSER-PLUGINS
2014-01-10	RealNetworks SMIL wallclock stack overflow attempt RuleID : 12728 - Revision : 13 - Type : FILE-MULTIMEDIA
2014-01-10	RealNetworks RealPlayer SMIL wallclock parsing buffer overflow RuleID : 12219 - Revision : 14 - Type : FILE-MULTIMEDIA
2014-01-10	RealPlayer Helix G2 Control ActiveX function call unicode access RuleID : 12026 - Revision : 2 - Type : WEB-CLIENT
2014-01-10	RealPlayer Helix G2 Control ActiveX function call access RuleID : 12025 - Revision : 2 - Type : WEB-CLIENT
2014-01-10	RealPlayer Helix G2 Control ActiveX clsid unicode access RuleID : 12024 - Revision : 2 - Type : WEB-CLIENT
2014-01-10	RealPlayer Helix G2 Control ActiveX clsid access RuleID : 12023 - Revision : 2 - Type : WEB-CLIENT

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-0605.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing a security update. File : sl_20070627_HelixPlayer_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2009-08-24	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0841.nasl - Type : ACT_GATHER_INFO
2008-01-07	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_f762ccbbbaed11dca302000102cc8983.nasl - Type : ACT_GATHER_INFO
2007-11-06	Name : The remote Fedora host is missing a security update. File : fedora_2007-0756.nasl - Type : ACT_GATHER_INFO
2007-10-30	Name : The remote Windows application is affected by several buffer overflow vulnera... File : realplayer_6_0_12_1662.nasl - Type : ACT_GATHER_INFO
2007-09-24	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200709-05.nasl - Type : ACT_GATHER_INFO
2007-06-29	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-0605.nasl - Type : ACT_GATHER_INFO
2007-06-29	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-0605.nasl - Type : ACT_GATHER_INFO
2007-06-27	Name : The remote Windows application is affected by a buffer overflow vulnerability. File : realplayer_6_0_12_1578.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:35:05	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	1
CPE ID(s)	10
Saint Exploit(s)	1
osvdb(s)	2
Openvas Exploit(s)	3
IAVM(s)	1
Snort® Rule(s)	10
Nessus® Exploit(s)	10

	Related
9.3	CVE-2007-3410
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)