----------------------------------------------------------------------

The Secunia CSI 5.0 Beta - now available for testing
Find out more, take a free test drive, and share your opinion with us: 
http://secunia.com/blog/242 

----------------------------------------------------------------------

TITLE:
RealPlayer Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA44014

VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/44014/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=44014

RELEASE DATE:
2011-08-18

DISCUSS ADVISORY:
http://secunia.com/advisories/44014/#comments

AVAILABLE ON SITE AND IN CUSTOMER AREA:
 * Last Update
 * Popularity
 * Comments
 * Criticality Level
 * Impact
 * Where
 * Solution Status
 * Operating System / Software
 * CVE Reference(s)

http://secunia.com/advisories/44014/

ONLY AVAILABLE IN CUSTOMER AREA:
 * Authentication Level
 * Report Reliability
 * Secunia PoC
 * Secunia Analysis
 * Systems Affected
 * Approve Distribution
 * Remediation Status
 * Secunia CVSS Score
 * CVSS

https://ca.secunia.com/?page=viewadvisory&vuln_id=44014

ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
 * AUTOMATED SCANNING

http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

DESCRIPTION:
Some vulnerabilities have been reported in RealPlayer, which can be
exploited by malicious people to compromise a user's system.

1) A use-after-free error exists in pngu3267.dll within the handling
of displayed dialog boxes when navigating away from a web page. This
can be exploited to dereference already freed memory by tricking a
user into visiting a specially crafted web page and e.g. display the
"Copyrights" or "Version Info" dialog box via the "About RealPlayer"
context menu or open the "About This Presentation" dialog box.

Successful exploitation of this vulnerability allows execution of
arbitrary code.

2) An unspecified error related to SIPR can be exploited to cause a
heap-based buffer overflow.

3) An unspecified error related to the RealPlayer ActiveX control can
be exploited to execute arbitrary code.

4) The application allows the processing of local HTML files with
scripting enabled, which can be exploited to execute arbitrary code
by e.g. tricking a user into visiting a malicious website.

5) An error within the handling of "DEFINEFONT" fields when parsing
Flash files can be exploited to cause a memory corruption.

6) A boundary error within the handling of certain ID3v2 tags in MP3
files can be exploited to cause a heap-based buffer overflow.

7) A boundary error within qcpfformat.dll when handling certain QCP
media files can be exploited to cause a heap-based buffer overflow.

8) An error within the parsing of AAC raw_data_frame elements can be
exploited to cause a buffer overflow.

9) An unspecified "Out of Bounds" error exists within the RealPlayer
ActiveX control

10) An unspecified use-after-free error related to "Embedded
AutoUpdate" exists within the RealPlayer ActiveX control.

11) An unspecified use-after-free error related to "Embedded Modal
Dialog" exists within the RealPlayer ActiveX control.

The vulnerabilities are reported in versions 14.0.0 through 14.0.5.
Other versions may also be affected.

SOLUTION:
Update to version 14.0.6.

PROVIDED AND/OR DISCOVERED BY:
1) Krystian Kloskowski (h07) via Secunia.
4) Martin Bartek via ZDI
5) Luigi Auriemma via ZDI
6, 7) Sean de Regge via ZDI
8) Donato Ferrante and Andrzej Dyjak via ZDI

The vendor credits:
2) Omair via iDefense Labs
3) getB33, via iDefense Labs
9, 10, 11) Luigi Auriemma

ORIGINAL ADVISORY:
RealNetworks:
http://service.real.com/realplayer/security/08162011_player/en/

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-11-265/
http://www.zerodayinitiative.com/advisories/ZDI-11-266/
http://www.zerodayinitiative.com/advisories/ZDI-11-267/
http://www.zerodayinitiative.com/advisories/ZDI-11-268/
http://www.zerodayinitiative.com/advisories/ZDI-11-269/

OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/

DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/

EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/

EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/

EXPLOIT:
Further details available in Customer Area:
http://secunia.com/vulnerability_intelligence/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------