Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Mulitple Buffer Overflow conditions in RealPlayer/RealOne

Mulitple Buffer Overflow conditions in RealPlayer/RealOne

by Nikola Strahija on November 24th, 2002 RealOne / RealPlayer is one of the most widely used products for internet media delivery. According to Real, there are currently around 115 million users worlwide of these products. RealOne is the updated version of RealPlayer. Both suffer from multiple overrun issues.


Details
*******
This advisory details three remotely exploitable overruns, two being heap
based overflows and the other being a stack based overflow. On exploitation
of these overruns any supplied code would execute in the security context of
the logged on user.

1) By following a link to a SMIL file (Synchronized Multimedia Integration
Language), RealPlayer will automatically download the file in an attempt to
play its content. By suppling an overly long paramter within the SMIL file
a heap overflow would occur in RealPlay.exe. According to Real, they have
fixed the issue by fixing the player status code to handle the cases where
there are large number of characters in the metadata of a smil file.

2) By suppling an overly long rtsp:// filename parameter, for example
within a .m3u file, when a link was followed, Real again would download the
file. When play is selected a heap overflow ocurrs in RealPlay.exe This
has apparently been fixed by Real by improving the robustness of URL
handling in this portion of the product.

3) Again, referring to number two if the 'victim' were to download the file
with a large filename (whether it was on local/rtsp or an http url) Real
Player would access violate when performing the following: If the user were
to right click in Now Playing and select "Edit Clip info" or right click in
"Now Playing" and "Select copy to my Library". In this particular instance
a stack overflow would occur in RealPlayer.


Fix Information
***************
NGSSoftware alerted Real to these problems on the 1st November 2002.
NGSSoftware highly recommend installing the patch found at
http://service.real.com/help/faq/security/bufferoverrun_player.html.
Alternatively if you Open RealPlayer - Help - About Real Player, you will
notice a Check For Updates feature. Select this.

In Real's own advisory they omit the fact that RealOne Enterprise Desktop is
also vulnerable, but only to issues 2 & 3.


Further Information
*******************
For further information about the scope and effects of buffer overflows,
please see

http://www.ngssoftware.com/papers/non-stack-bo-windows.pdf
http://www.ngssoftware.com/papers/ntbufferoverflow.html
http://www.ngssoftware.com/papers/bufferoverflowpaper.rtf
http://www.ngssoftware.com/papers/unicodebo.pdf


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »