Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
Arbitrary Code Execution Vulnerability in RealPlayer - 05 Oct 2004
A vulnerability in RealPlayer could let a remote attacker reliably overwrite heap memory with arbitrary data and execute arbitrary code within the user security context.
Ken Pfeil
October 4, 2004
1 Min Read
Reported October 01, 2004, by eEyeDigital Security
VERSIONS AFFECTED
DESCRIPTION
A vulnerability in RealPlayer could let a remote attacker reliably overwriteheap memory with arbitrary data and execute arbitrary code within the usersecurity context. This specific flaw exists within the pnen3260.dll file that RealPlayeruses. By specially crafting a malformed .rm movie file along with a SynchronizedMultimedia Integration Language (SMIL) file, a direct heap overwrite istriggered and reliable code execution is then possible.
VENDOR RESPONSE
RealNetworks has released has released a patch for thisvulnerability, which is also available via the Updates section of the affectedapplication.
CREDIT
Discovered by eEye Digital Security.
About the Author
You May Also Like
.jpg?width=700&auto=webp&quality=80&disable=upscale)
