RealPlayer Zipped Skin File Buffer Overflow II

Release Date:
November 10, 2005

Date Reported:
June 26, 2005

Severity:
High (Code Execution)

Vendor:
RealNetworks

Systems Affected:
Windows:
RealPlayer 10.5 (6.0.12.1040-1235)
RealPlayer 10
RealOne Player v2
RealOne Player v1
RealPlayer 8

Overview:
eEye Digital Security has discovered a vulnerability in RealPlayer that
allows a remote attacker to reliably overwrite the heap with arbitrary
data and execute arbitrary code in the context of the user under which
the player is running.

Technical Details:
A RealPlayer skin file (.rjs extension) can be downloaded and applied
automatically through a web browser without the user's permission. A
skin file is a bundle of graphics and a .ini file, stored together in
ZIP format. DUNZIP32.DLL, which is included with RealPlayer, is used to
extract the contents of the skin file. When RealPlayer processes a zip
file, it will allocate the field of the file but when it is copied it
will rely on real unzip content to copy. So an attacker can zip one file
that has hostile data and create a rjs file.  We can change the file
length field of rjs file so when it process this zip file it will cause
a heap overflow.

Protection:
Retina Network Security Scanner has been updated to identify this
vulnerability.

Vendor Status:
RealNetworks has released a patch for this vulnerability. The patch is
available via the "Check for Update" menu item under Tools on the
RealPlayer menu bar or from http://service.real.com/realplayer/security/

Credit:
Fang Xing 

Related Links:
This vulnerability has been assigned the following ID numbers;

EEYEB-20050701
OSVDB ID: 18827
CVE ID: CAN-2005-2630

Greetings:
Thanks to Karl Lynn and the eeye guys for helping me analyze and write
the advisory, greets to xfocus and venus-tech lab guys.

Copyright (c) 1998-2005 eEye Digital Security
Permission is hereby granted for the redistribution of this alert
electronically. It is not to be edited in any way without express
consent of eEye. If you wish to reprint the whole or any part of this
alert in any other medium excluding electronic medium, please email
alert@eEye.com for permission.

Disclaimer
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are no warranties, implied or express, with regard to this information.
In no event shall the author be liable for any direct or indirect
damages whatsoever arising out of or in connection with the use or
spread of this information. Any use of this information is at the user's
own risk.