TPTI-10-17: RealNetworks RealPlayer SIPR Stream Frame Dimensions Remote Code Execution Vulnerability

http://dvlabs.tippingpoint.com/advisory/TPTI-10-17

December 10, 2010

-- CVE ID:
CVE-2010-4385

-- CVSS:
9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)

-- Affected Vendors:
RealNetworks

-- Affected Products:
RealNetworks RealPlayer

-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability by Digital Vaccine protection filter ID 9674.
For further product information on the TippingPoint IPS, visit:

    http://www.tippingpoint.com

-- Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of RealNetworks RealPlayer. Authentication is
not required to exploit this vulnerability.

The specific flaw exists within the drv1.dll module. Code responsible
for parsing SIPR stream metadata trusts frame width and height values
from the input file. By crafting particular values an integer value used
in a loop can be made to wrap negatively. The loop will subsequently
overflow a static heap buffer during an inline memory copy. By crafting
a malicious .rm file an attacker can exploit this vulnerability remotely
using the RealPlayer ActiveX control.

-- Vendor Response:
RealNetworks has issued an update to correct this vulnerability. More
details can be found at:

http://service.real.com/realplayer/security/12102010_player/en/

-- Disclosure Timeline:
2010-02-26 - Vulnerability reported to vendor
2010-12-10 - Coordinated public release of advisory

-- Credit:
This vulnerability was discovered by:
    * Aaron Portnoy, Zef Cekaj, Logan Brown