[NEWS] RealNetworks RealPlayer RealText Parsing Heap Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  RealNetworks RealPlayer RealText Parsing Heap Overflow
------------------------------------------------------------------------


SUMMARY

 <http://www.real.com/player/?src=realplayer> RealPlayer is "a popular 
media player".

Remote exploitation of a heap-based buffer overflow vulnerability in the 
RealText file format parser within various versions of  RealPlayer could 
allow attackers to execute arbitrary code.

DETAILS

Vulnerable Systems:
 * RealPlayer version 10.5 6.0.12.1056
 * RealPlayer version 10 and 10.0.1.436

It is suspected that previous versions of RealPlayer are also vulnerable. 
It is also suspected that RealOne player is vulnerable.

CVE Information:
 <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1277> 
CAN-2005-1277

Vulnerable Code:
The vulnerability specifically exists because of a string copying 
operating into a fixed size heap buffer using the sprintf function. The 
following function from /datatype/text/realtext/fileformat/rtffplin.cpp is 
the offending code:

STDMETHODIMP CRealTextFileFormat::ReadDone()
[...]
                 if (pErrorMessages)
                 {
                    const char* pFilename = "[rt file]";
                    if(m_pFileObject)
                    {
                         m_pFileObject->GetFilename(pFilename);
                    }
                    char* pTmp;
                    pTmp = new char[256];
                    sprintf(pTmp,  /* Flawfinder: ignore */

                     "Version in \"%s\" is not recognized installed"

                     " RealText file format",pFilename);
                    pErrorMessages->Report(HXLOG_ERR,
                                      HXR_INVALID_VERSION,
                                      0, (const char*) pTmp, NULL);
                    HX_RELEASE(pErrorMessages);
                    delete [] pTmp;
                 }
[...]

The variable pTmp points to 256 bytes of space on the heap. pFilename is a 
string pointer that points to data supplied in the RealText stream. When 
the sprintf is executed, the data is copied into the 256 byte heap buffer 
without any length checking, thus allowing a heap overflow to occur. Once 
the heap is overflown, an attacker can eventually write to arbitrary 
locations in memory, allowing for the execution of arbitrary code.

Exploitation allows for arbitrary code execution as the user who opened 
the RealMedia file. Exploitation requires an attacker to craft a malicious 
RealMedia file that uses RealText and convince a user to open it. An 
attacker could also force a web browser to refresh and automatically load 
the RealMedia file from a normal web page under the attacker's control.

In default installations of RealPlayer under Windows XP, Internet Explorer 
will not prompt the user for an action when encountering most RealMedia 
files. It will open the file without delay, thus providing an effective 
method of exploitation.

Workaround:
Although there is no way to completely protect yourself from this 
vulnerability, aside from removing the RealPlayer software, the following 
actions may be taken to minimize risk for automated exploitation. Disable 
ActiveX controls and plugins, if not necessary for daily operations, using 
the following steps:

1. In IE, click on Tools and select Internet Options from the drop-down 
menu.
2. Click the Security tab and the Custom Level button.
3. Under ActiveX Controls and Plugins, then Run Activex Controls and 
Plugins, click the Disable radio button.

Vendor Status:
The vendor has addressed this issue in the following security advisory. 
The patch can be found at:  
<http://service.real.com/help/faq/security/050623_player/EN/> 
http://service.real.com/help/faq/security/050623_player/EN/

Disclosure Timeline:
04/26/2005 - Initial vendor notification
04/26/2005 - Initial vendor response
06/23/2005 - Coordinated public disclosure


ADDITIONAL INFORMATION

The information has been provided by  <mailto:iDEFENSE> 
[email protected].
The original article can be found at:  
<http://www.idefense.com/application/poi/display?id=250&type=vulnerabilities> www.idefense.com/application/poi/display?id=250&type=vulnerabilities



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.