Multiple vulnerabilities have been identified in RealNetworks RealPlayer, which could be exploited by remote attackers to compromise a vulnerable system.

The first issue is caused by a heap overflow error when processing a malformed ASM Rulebook, which could be exploited to execute arbitrary code.

The second vulnerability is caused by a heap overflow error when processing a malformed GIF file, which could be exploited to execute arbitrary code.

The third issue is caused by a buffer overflow error when processing a malformed media file, which could be exploited to execute arbitrary code.

The fourth vulnerability is caused by a buffer overflow error when processing a malformed IVR file, which could be exploited to execute arbitrary code.

The fifth vulnerability is caused by a heap overflow error when processing a malformed IVR file, which could be exploited to execute arbitrary code.

The sixth issue is caused by a heap overflow error related to the SIPR Codec, which could be exploited to execute arbitrary code.

The seventh vulnerability is caused by a heap overflow error when processing a malformed compressed GIF, which could be exploited to execute arbitrary code.

The eighth issue is caused by a heap overflow error when parsing a malformed SMIL file, which could be exploited to execute arbitrary code.

The ninth vulnerability is caused by a heap overflow error when parsing a malformed Skin, which could be exploited to execute arbitrary code.

The tenth issue is caused by an array overflow error when parsing a malformed ASM RuleBook, which could be exploited to execute arbitrary code.

The eleventh vulnerability is caused by a buffer overflow error related to rtsp "set_parameter" method, which could be exploited to execute arbitrary code.

Affected Products

RealPlayer SP versions 1.x
RealPlayer versions 11.x
RealPlayer versions 10.x
RealPlayer Enterprise
Mac RealPlayer versions 11.x
Mac RealPlayer versions 10.x
Linux RealPlayer versions 11.x
Linux RealPlayer versions 10.x
Helix Player versions 11.x
Helix Player versions 10.x

Solution

Upgrade to fixed versions :
http://service.real.com/realplayer/security/01192010_player/en/

References

http://www.vupen.com/english/advisories/2010/0178
http://service.real.com/realplayer/security/01192010_player/en/

In-depth Binary Analysis

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Private Exploit or PoC

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Credits

Vulnerabilities reported by Evgeny Legerov, iDEFENSE Labs, John Rambo via ZDI, and the vendor.

Changelog

2010-01-20 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.