Vulnerability CVE-2005-2629
Published: 2005-11-18   Modified: 2012-02-12

Description:
Integer overflow in RealNetworks RealPlayer 8, 10, and 10.5, RealOne Player 1 and 2, and Helix Player 10.0.0 allows remote attackers to execute arbitrary code via an .rm movie file with a large value in the length field of the first data packet, which leads to a stack-based buffer overflow, a different vulnerability than CVE-2004-1481.

See advisories in our WLB2 database:
Topic
Author
Date
High
RealPlayer Data Packet Stack Overflow
Karl Lynn
11.11.2005

Type:

CWE-Other

CVSS2 => (AV:N/AC:H/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.1/10
6.4/10
4.9/10
Exploit range
Attack complexity
Authentication
Remote
High
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Realnetworks -> Helix player 
Realnetworks -> Realone player 
Realnetworks -> Realplayer 

 References:
http://marc.info/?l=bugtraq&m=113166476423021&w=2
http://securityreason.com/securityalert/169
http://securitytracker.com/id?1015184
http://securitytracker.com/id?1015185
http://securitytracker.com/id?1015186
http://service.real.com/help/faq/security/051110_player/EN/
http://www.debian.org/security/2005/dsa-915
http://www.eeye.com/html/research/advisories/AD20051110a.html
http://www.securityfocus.com/bid/15381/
https://exchange.xforce.ibmcloud.com/vulnerabilities/23024
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9550
Copyright 2024, cxsecurity.com

 

Back to Top