RealPlayer Zipped Skin File Buffer Overflow II Release Date: November 10, 2005 Date Reported: June 26, 2005 Severity: High (Code Execution) Vendor: RealNetworks Systems Affected: Windows: RealPlayer 10.5 (6.0.12.1040-1235) RealPlayer 10 RealOne Player v2 RealOne Player v1 RealPlayer 8 Overview: eEye Digital Security has discovered a vulnerability in RealPlayer that allows a remote attacker to reliably overwrite the heap with arbitrary data and execute arbitrary code in the context of the user under which the player is running. Technical Details: A RealPlayer skin file (.rjs extension) can be downloaded and applied automatically through a web browser without the user's permission. A skin file is a bundle of graphics and a .ini file, stored together in ZIP format. DUNZIP32.DLL, which is included with RealPlayer, is used to extract the contents of the skin file. When RealPlayer processes a zip file, it will allocate the field of the file but when it is copied it will rely on real unzip content to copy. So an attacker can zip one file that has hostile data and create a rjs file. We can change the file length field of rjs file so when it process this zip file it will cause a heap overflow. Protection: Retina Network Security Scanner has been updated to identify this vulnerability. Vendor Status: RealNetworks has released a patch for this vulnerability. The patch is available via the "Check for Update" menu item under Tools on the RealPlayer menu bar or from http://service.real.com/realplayer/security/ Credit: Fang Xing Related Links: This vulnerability has been assigned the following ID numbers; EEYEB-20050701 OSVDB ID: 18827 CVE ID: CAN-2005-2630 Greetings: Thanks to Karl Lynn and the eeye guys for helping me analyze and write the advisory, greets to xfocus and venus-tech lab guys. Copyright (c) 1998-2005 eEye Digital Security Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert (at) eEye (dot) com [email concealed] for permission. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.