Executive Summary
Summary | |
---|---|
Title | HelixPlayer security update |
Informations | |||
---|---|---|---|
Name | RHSA-2010:0094 | First vendor Publication | 2010-02-09 |
Vendor | RedHat | Last vendor Modification | 2010-02-09 |
Severity (Vendor) | Critical | Revision | 02 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: An updated HelixPlayer package that fixes several security issues is now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ppc, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, x86_64 Red Hat Enterprise Linux WS version 4 - i386, x86_64 3. Description: HelixPlayer is a media player. Multiple buffer and integer overflow flaws were found in the way HelixPlayer processed Graphics Interchange Format (GIF) files. An attacker could create a specially-crafted GIF file which would cause HelixPlayer to crash or, potentially, execute arbitrary code when opened. (CVE-2009-4242, CVE-2009-4245) A buffer overflow flaw was found in the way HelixPlayer processed Synchronized Multimedia Integration Language (SMIL) files. An attacker could create a specially-crafted SMIL file which would cause HelixPlayer to crash or, potentially, execute arbitrary code when opened. (CVE-2009-4257) A buffer overflow flaw was found in the way HelixPlayer handled the Real Time Streaming Protocol (RTSP) SET_PARAMETER directive. A malicious RTSP server could use this flaw to crash HelixPlayer or, potentially, execute arbitrary code. (CVE-2009-4248) Multiple buffer overflow flaws were discovered in the way HelixPlayer handled RuleBook structures in media files and RTSP streams. Specially-crafted input could cause HelixPlayer to crash or, potentially, execute arbitrary code. (CVE-2009-4247, CVE-2010-0417) A buffer overflow flaw was found in the way HelixPlayer performed URL un-escaping. A specially-crafted URL string could cause HelixPlayer to crash or, potentially, execute arbitrary code. (CVE-2010-0416) All HelixPlayer users are advised to upgrade to this updated package, which contains backported patches to resolve these issues. All running instances of HelixPlayer must be restarted for this update to take effect. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 561309 - CVE-2009-4257 HelixPlayer / RealPlayer: SMIL getAtom heap buffer overflow 561338 - CVE-2009-4247 HelixPlayer / RealPlayer: RTSP client ASM RuleBook stack buffer overflow 561361 - CVE-2009-4248 HelixPlayer / RealPlayer: RTSP SET_PARAMETER buffer overflow 561436 - CVE-2009-4242 HelixPlayer / RealPlayer: GIF file heap overflow 561441 - CVE-2009-4245 HelixPlayer / RealPlayer: compressed GIF heap overflow 561856 - CVE-2010-0416 HelixPlayer / RealPlayer: URL unescape buffer overflow 561860 - CVE-2010-0417 HelixPlayer / RealPlayer: rule book handling heap corruption |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2010-0094.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:10144 | |||
Oval ID: | oval:org.mitre.oval:def:10144 | ||
Title: | Heap-based buffer overflow in the CGIFCodec::GetPacketBuffer function in datatype/image/gif/common/gifcodec.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via a GIF file with crafted chunk sizes that trigger improper memory allocation. | ||
Description: | Heap-based buffer overflow in the CGIFCodec::GetPacketBuffer function in datatype/image/gif/common/gifcodec.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via a GIF file with crafted chunk sizes that trigger improper memory allocation. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-4242 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:10641 | |||
Oval ID: | oval:org.mitre.oval:def:10641 | ||
Title: | Buffer overflow in the RTSPProtocol::HandleSetParameterRequest function in client/core/rtspprotocol.cpp in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted RTSP SET_PARAMETER request. | ||
Description: | Buffer overflow in the RTSPProtocol::HandleSetParameterRequest function in client/core/rtspprotocol.cpp in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted RTSP SET_PARAMETER request. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-4248 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:10677 | |||
Oval ID: | oval:org.mitre.oval:def:10677 | ||
Title: | Stack-based buffer overflow in protocol/rtsp/rtspclnt.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.x; RealPlayer SP 1.0.0 and 1.0.1; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, 11.0, and 11.0.1; Linux RealPlayer 10, 11.0.0, and 11.0.1; and Helix Player 10.x, 11.0.0, and 11.0.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an ASM RuleBook with a large number of rules, related to an "array overflow." | ||
Description: | Stack-based buffer overflow in protocol/rtsp/rtspclnt.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.x; RealPlayer SP 1.0.0 and 1.0.1; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, 11.0, and 11.0.1; Linux RealPlayer 10, 11.0.0, and 11.0.1; and Helix Player 10.x, 11.0.0, and 11.0.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an ASM RuleBook with a large number of rules, related to an "array overflow." | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-4247 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:10847 | |||
Oval ID: | oval:org.mitre.oval:def:10847 | ||
Title: | Buffer overflow in the Unescape function in common/util/hxurl.cpp and player/hxclientkit/src/CHXClientSink.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a URL argument containing a % (percent) character that is not followed by two hex digits. | ||
Description: | Buffer overflow in the Unescape function in common/util/hxurl.cpp and player/hxclientkit/src/CHXClientSink.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a URL argument containing a % (percent) character that is not followed by two hex digits. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2010-0416 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:11110 | |||
Oval ID: | oval:org.mitre.oval:def:11110 | ||
Title: | Heap-based buffer overflow in datatype/smil/common/smlpkt.cpp in smlrender.dll in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10 and 11.0.0, and Helix Player 10.x and 11.0.0 allows remote attackers to execute arbitrary code via an SMIL file with crafted string lengths. | ||
Description: | Heap-based buffer overflow in datatype/smil/common/smlpkt.cpp in smlrender.dll in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10 and 11.0.0, and Helix Player 10.x and 11.0.0 allows remote attackers to execute arbitrary code via an SMIL file with crafted string lengths. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-4257 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:11364 | |||
Oval ID: | oval:org.mitre.oval:def:11364 | ||
Title: | Buffer overflow in common/util/rlstate.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a RuleBook structure with a large number of rule-separator characters that trigger heap memory corruption. | ||
Description: | Buffer overflow in common/util/rlstate.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a RuleBook structure with a large number of rule-separator characters that trigger heap memory corruption. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2010-0417 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:9998 | |||
Oval ID: | oval:org.mitre.oval:def:9998 | ||
Title: | Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a compressed GIF file, related to gifcodec.cpp and gifimage.cpp. | ||
Description: | Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a compressed GIF file, related to gifcodec.cpp and gifimage.cpp. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-4245 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2010-02-15 | Name : CentOS Update for HelixPlayer CESA-2010:0094 centos4 i386 File : nvt/gb_CESA-2010_0094_HelixPlayer_centos4_i386.nasl |
2010-02-15 | Name : RedHat Update for HelixPlayer RHSA-2010:0094-02 File : nvt/gb_RHSA-2010_0094-02_HelixPlayer.nasl |
2010-02-02 | Name : RealNetworks RealPlayer ASM RuleBook BOF Vulnerability (Linux) File : nvt/secpod_realplayer_asm_ruleboook_bof_lin.nasl |
2010-02-02 | Name : RealNetworks RealPlayer ASM RuleBook BOF Vulnerability (Win) File : nvt/secpod_realplayer_asm_ruleboook_bof_win.nasl |
2010-02-02 | Name : RealNetworks RealPlayer Multiple Code Execution Vulnerabilities (Linux) File : nvt/secpod_realplayer_mult_code_exec_vuln_lin.nasl |
2010-02-02 | Name : RealNetworks RealPlayer Multiple Code Execution Vulnerabilities (Win) File : nvt/secpod_realplayer_mult_code_exec_vuln_win.nasl |
2010-02-02 | Name : RealNetworks RealPlayer SMIL file BOF Vulnerability (Linux) File : nvt/secpod_realplayer_smil_bof_lin.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
62471 | RealNetworks Multiple Products common/util/rlstate.cpp RuleBook Structure Ove... |
62470 | RealNetworks Multiple Products player/hxclientkit/src/CHXClientSink.cpp Unesc... |
62469 | RealNetworks Multiple Products xcommon/util/hxurl.cpp Unescape Function Overflow |
61973 | RealNetworks Multiple Products smlrender.dll SMIL File Handling Overflow |
61972 | RealNetworks Multiple Products CMediumBlockAllocator::Alloc Method Crafted RT... |
61971 | RealNetworks Multiple Products Crafted ASM RuleBook Overflow |
61969 | RealNetworks Multiple Products Compressed GIF File Handling Overflow |
61966 | RealNetworks Multiple Products Crafted GIF File Chunk Size Overflow |
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2010-02-18 | IAVM : 2010-A-0022 - Multiple HelixPlayer Vulnerabilities in Red Hat Enterprise Linux 4 Severity : Category II - VMSKEY : V0022670 |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2010-0094.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20100209_HelixPlayer_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
2010-02-10 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2010-0094.nasl - Type : ACT_GATHER_INFO |
2010-02-10 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2010-0094.nasl - Type : ACT_GATHER_INFO |
2010-01-22 | Name : The remote Windows application is affected by multiple buffer overflow vulner... File : realplayer_12_0_0_319.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:53:13 |
|