CVE-2010-4378

Related Files

Zero Day Initiative Advisory 10-274

Posted Dec 11, 2010

Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 10-274 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page. The specific flaw exists within the module responsible for decompressing RV20 video streams. The drv2.dll trusts a value from the file as a length and uses it within a copy loop that writes to heap memory. By specifying large enough values, heap memory can be corrupted which can lead to arbitrary code execution under the context of the user accessing the media file.

tags | advisory, remote, arbitrary, code execution

advisories | CVE-2010-4378

SHA-256 | 7f73e7b515fa0cac4f27f4ab41cae25300467be42116301a8e8fd4379973e287

Download | Favorite | View