9.3 - RHSA-2005:762

Executive Summary

Summary
Title	RealPlayer security update

Informations
Name	RHSA-2005:762	First vendor Publication	2005-09-27
Vendor	RedHat	Last vendor Modification	2005-09-27
Severity (Vendor)	Critical	Revision	02

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

An updated RealPlayer package that fixes a format string bug is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 Extras - i386, x86_64 Red Hat Desktop version 3 Extras - i386, x86_64 Red Hat Enterprise Linux ES version 3 Extras - i386, x86_64 Red Hat Enterprise Linux WS version 3 Extras - i386, x86_64 Red Hat Enterprise Linux AS version 4 Extras - i386, x86_64 Red Hat Desktop version 4 Extras - i386, x86_64 Red Hat Enterprise Linux ES version 4 Extras - i386, x86_64 Red Hat Enterprise Linux WS version 4 Extras - i386, x86_64

3. Problem description:

RealPlayer is a media player that provides media playback locally and via streaming.

A format string bug was discovered in the way RealPlayer processes RealPix (.rp) files. It is possible for a malformed RealPix file to execute arbitrary code as the user running RealPlayer. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-2710 to this issue.

All users of RealPlayer are advised to upgrade to this updated package, which contains RealPlayer version 10.0.6 and is not vulnerable to this issue.

4. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs.

Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

167891 - CAN-2005-2710 Format String Flaw

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2005-762.html

CAPEC : Common Attack Pattern Enumeration & Classification

Id	Name
CAPEC-220	Client-Server Protocol Manipulation

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11015

Oval ID:	oval:org.mitre.oval:def:11015
Title:	Format string vulnerability in Real HelixPlayer and RealPlayer 10 allows remote attackers to execute arbitrary code via the (1) image handle or (2) timeformat attribute in a RealPix (.rp) or RealText (.rt) file.
Description:	Format string vulnerability in Real HelixPlayer and RealPlayer 10 allows remote attackers to execute arbitrary code via the (1) image handle or (2) timeformat attribute in a RealPix (.rp) or RealText (.rt) file.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-2710	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4	Product(s):
Definition Synopsis:
RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND HelixPlayer is earlier than 1:1.0.6-0.EL4.1

Definition Id: oval:org.mitre.oval:def:11444

Oval ID:	oval:org.mitre.oval:def:11444
Title:	Heap-based buffer overflow in the embedded player in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, and Helix Player allows remote malicious servers to cause a denial of service (crash) and possibly execute arbitrary code via a chunked Transfer-Encoding HTTP response in which either (1) the chunk header length is specified as -1, (2) the chunk header with a length that is less than the actual amount of sent data, or (3) a missing chunk header.
Description:	Heap-based buffer overflow in the embedded player in multiple RealNetworks products and versions including RealPlayer 10.x, RealOne Player, and Helix Player allows remote malicious servers to cause a denial of service (crash) and possibly execute arbitrary code via a chunked Transfer-Encoding HTTP response in which either (1) the chunk header length is specified as -1, (2) the chunk header with a length that is less than the actual amount of sent data, or (3) a missing chunk header.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-2922	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4	Product(s):
Definition Synopsis:
RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND HelixPlayer is earlier than 1:1.0.6-0.EL4.1

Definition Id: oval:org.mitre.oval:def:11454

Oval ID:	oval:org.mitre.oval:def:11454
Title:	The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.
Description:	The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-2969	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section openssl-perl is earlier than 0:0.9.7a-33.17 AND openssl-devel is earlier than 0:0.9.7a-33.17 AND openssl is earlier than 0:0.9.7a-33.17 AND openssl096b is earlier than 0:0.9.6b-16.22.4 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section openssl-perl is earlier than 0:0.9.7a-43.4 AND openssl-devel is earlier than 0:0.9.7a-43.4 AND openssl is earlier than 0:0.9.7a-43.4 AND openssl096b is earlier than 0:0.9.6b-22.4

CPE : Common Platform Enumeration

Type	Description	Count
Application	Openssl cpe:2.3:a:openssl:openssl:0.9.8:-:::::: cpe:2.3:a:openssl:openssl:0.9.7g:::::::* cpe:2.3:a:openssl:openssl:0.9.7f:::::::* cpe:2.3:a:openssl:openssl:0.9.7e:::::::* cpe:2.3:a:openssl:openssl:0.9.7d:::::::* cpe:2.3:a:openssl:openssl:0.9.7c:::::::* cpe:2.3:a:openssl:openssl:0.9.7b:::::::* cpe:2.3:a:openssl:openssl:0.9.7a:::::::* cpe:2.3:a:openssl:openssl:0.9.7:-::::::	9
Application	Realnetworks Helix Player cpe:2.3:a:realnetworks:helix_player:10.0.6::linux::::: cpe:2.3:a:realnetworks:helix_player:10.0.5::linux::::: cpe:2.3:a:realnetworks:helix_player:10.0.4::linux::::: cpe:2.3:a:realnetworks:helix_player:10.0.3::linux::::: cpe:2.3:a:realnetworks:helix_player:10.0.2::linux::::: cpe:2.3:a:realnetworks:helix_player:10.0.1::linux::::: cpe:2.3:a:realnetworks:helix_player:10.0::linux::::: cpe:2.3:a:realnetworks:helix_player::::::::	8
Application	Realnetworks Realone Player cpe:2.3:a:realnetworks:realone_player:2.0:::::::* cpe:2.3:a:realnetworks:realone_player:1.0:::::::* cpe:2.3:a:realnetworks:realone_player:0.297::mac_os_x::::: cpe:2.3:a:realnetworks:realone_player:0.288::mac_os_x::::: cpe:2.3:a:realnetworks:realone_player::::::::	5
Application	Realnetworks Realplayer cpe:2.3:a:realnetworks:realplayer:10.5_6.0.12.1235:::::::* cpe:2.3:a:realnetworks:realplayer:10.5_6.0.12.1069:::::::* cpe:2.3:a:realnetworks:realplayer:10.5_6.0.12.1059:::::::* cpe:2.3:a:realnetworks:realplayer:10.5_6.0.12.1056:::::::* cpe:2.3:a:realnetworks:realplayer:10.5_6.0.12.1053:::::::* cpe:2.3:a:realnetworks:realplayer:10.5_6.0.12.1040:::::::* cpe:2.3:a:realnetworks:realplayer:10.5:::::::* cpe:2.3:a:realnetworks:realplayer:10.0.6::linux::::: cpe:2.3:a:realnetworks:realplayer:10.0.5::linux::::: cpe:2.3:a:realnetworks:realplayer:10.0.4::linux::::: cpe:2.3:a:realnetworks:realplayer:10.0.3::linux::::: cpe:2.3:a:realnetworks:realplayer:10.0.2::linux::::: cpe:2.3:a:realnetworks:realplayer:10.0.1::linux::::: cpe:2.3:a:realnetworks:realplayer:10.0.0.331::mac_os::::: cpe:2.3:a:realnetworks:realplayer:10.0.0.305::mac_os::::: cpe:2.3:a:realnetworks:realplayer:10.0:::::::* cpe:2.3:a:realnetworks:realplayer:8.0::win32::::: cpe:2.3:a:realnetworks:realplayer:::enterprise:::::*	18
Application	Realnetworks Rhapsody cpe:2.3:a:realnetworks:rhapsody:3.0_build_0.815:::::::* cpe:2.3:a:realnetworks:rhapsody:3.0:::::::*	2

SAINT Exploits

Description	Link
RealPlayer invalid chunk header heap overflow	More info here

OpenVAS Exploits

Date	Description
2009-11-17	Name : Mac OS X Version File : nvt/macosx_version.nasl
2009-10-10	Name : SLES9: Security update for OpenSSL File : nvt/sles9p5012506.nasl
2009-06-03	Name : Solaris Update for kernel 120011-14 File : nvt/gb_solaris_120011_14.nasl
2009-06-03	Name : Solaris Update for kernel 127128-11 File : nvt/gb_solaris_127128_11.nasl
2009-05-05	Name : HP-UX Update for Apache Remote Execution of Arbitrary Code HPSBUX02186 File : nvt/gb_hp_ux_HPSBUX02186.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200510-07 (realplayer helixplayer) File : nvt/glsa_200510_07.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200510-11 (OpenSSL) File : nvt/glsa_200510_11.nasl
2008-09-04	Name : FreeBSD Ports: linux-realplayer File : nvt/freebsd_linux-realplayer3.nasl
2008-09-04	Name : FreeBSD Ports: openssl, openssl-overwrite-base File : nvt/freebsd_openssl0.nasl
2008-09-04	Name : FreeBSD Security Advisory (FreeBSD-SA-05:21.openssl.asc) File : nvt/freebsdsa_openssl2.nasl
2008-01-17	Name : Debian Security Advisory DSA 826-1 (helix-player) File : nvt/deb_826_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 875-1 (openssl094) File : nvt/deb_875_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 881-1 (openssl096) File : nvt/deb_881_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 882-1 (openssl095) File : nvt/deb_882_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 888-1 (openssl) File : nvt/deb_888_1.nasl
0000-00-00	Name : Slackware Advisory SSA:2005-286-01 OpenSSL File : nvt/esoft_slk_ssa_2005_286_01.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
24062	RealNetworks Multiple Products Web Page Embedded Player Content Overflow
19919	OpenSSL SSL_OP_ALL SSL 2.0 Verification Weakness
19696	RealNetworks Helix Player invalid-handle Error Message Format String <PRODUCT> contains a flaw that may allow a malicious user to <ISSUE_DESCRIPTION>. The issue is triggered when <CONDITION> occurs. It is possible that the flaw may allow <IMPACT> resulting in a loss of <confidentiality, integrity, and/or availability>. c0ntex has discovered a vulnerability in Helix Player, which potentially can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to a format string error when displaying the invalid-handle error message. This may be exploited to execute arbitrary code via a specially crafted ".rp" file. The ".rt" file format may also be affected. Successful exploitation requires that the user is e.g. tricking into opening or following a link to a malicious ".rp" file. The vulnerability has been confirmed in Helix Player 1.0.5.757 (gold), and affects only the Linux/Unix platforms. Other versions may also be affected.
19695	RealPlayer invalid-handle Error Message Format String

Snort® IPS/IDS

Date	Description
2014-01-10	RealNetworks RealPlayer error message format string vulnerability attempt RuleID : 8091 - Revision : 15 - Type : FILE-MULTIMEDIA
2014-01-10	RealNetworks RealPlayer invalid chunk size heap overflow attempt RuleID : 17666 - Revision : 13 - Type : FILE-MULTIMEDIA
2014-01-10	Multiple web browsers HTTP chunked transfer-encoding memory corruption attempt RuleID : 15462 - Revision : 20 - Type : BROWSER-OTHER

Nessus® Vulnerability Scanner

Date	Description
2014-10-10	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL5533.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-762.nasl - Type : ACT_GATHER_INFO
2012-01-04	Name : The remote server is vulnerable to man-in-the-middle attacks. File : openssl_0_9_7h_0_9_8a.nasl - Type : ACT_GATHER_INFO
2010-01-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0629.nasl - Type : ACT_GATHER_INFO
2010-01-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0525.nasl - Type : ACT_GATHER_INFO
2010-01-10	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0264.nasl - Type : ACT_GATHER_INFO
2007-01-08	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2005-788.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-888.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-875.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-882.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-881.nasl - Type : ACT_GATHER_INFO
2006-07-03	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-800.nasl - Type : ACT_GATHER_INFO
2006-05-13	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_60e26a403b2511da948400123ffe8333.nasl - Type : ACT_GATHER_INFO
2006-05-13	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_fe4c84fcbdb511dab7d400123ffe8333.nasl - Type : ACT_GATHER_INFO
2006-03-27	Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2006_018.nasl - Type : ACT_GATHER_INFO
2006-03-24	Name : The remote Windows application is affected by several issues. File : realplayer_6_0_12_1483.nasl - Type : ACT_GATHER_INFO
2006-01-15	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-204-1.nasl - Type : ACT_GATHER_INFO
2005-11-30	Name : The remote operating system is missing a vendor-supplied patch. File : macosx_SecUpd2005-009.nasl - Type : ACT_GATHER_INFO
2005-10-20	Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2005_061.nasl - Type : ACT_GATHER_INFO
2005-10-19	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2005-286-01.nasl - Type : ACT_GATHER_INFO
2005-10-19	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-800.nasl - Type : ACT_GATHER_INFO
2005-10-19	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-179.nasl - Type : ACT_GATHER_INFO
2005-10-19	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200510-11.nasl - Type : ACT_GATHER_INFO
2005-10-19	Name : The remote Fedora Core host is missing one or more security updates. File : fedora_2005-986.nasl - Type : ACT_GATHER_INFO
2005-10-19	Name : The remote Fedora Core host is missing one or more security updates. File : fedora_2005-985.nasl - Type : ACT_GATHER_INFO
2005-10-11	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200510-07.nasl - Type : ACT_GATHER_INFO
2005-10-11	Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2005_059.nasl - Type : ACT_GATHER_INFO
2005-10-05	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-788.nasl - Type : ACT_GATHER_INFO
2005-10-05	Name : The remote Debian host is missing a security-related update. File : debian_DSA-826.nasl - Type : ACT_GATHER_INFO
2005-10-05	Name : The remote Fedora Core host is missing a security update. File : fedora_2005-941.nasl - Type : ACT_GATHER_INFO
2005-10-05	Name : The remote Fedora Core host is missing a security update. File : fedora_2005-940.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:49:39	Multiple Updates

Global Informations

Type	Count
Capec ID(s)	1
CWE ID(s)	2
Oval ID(s)	3
CPE ID(s)	42
Saint Exploit(s)	1
osvdb(s)	4
Openvas Exploit(s)	16
Snort® Rule(s)	3
Nessus® Exploit(s)	31

	Related
9.3	CVE-2005-2922
5.1	CVE-2005-2710
5	CVE-2005-2969
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 3 more Alert(s)