National Cyber Awareness System

Vulnerability Summary for CVE-2009-4247

Overview

Stack-based buffer overflow in protocol/rtsp/rtspclnt.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.x; RealPlayer SP 1.0.0 and 1.0.1; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, 11.0, and 11.0.1; Linux RealPlayer 10, 11.0.0, and 11.0.1; and Helix Player 10.x, 11.0.0, and 11.0.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an ASM RuleBook with a large number of rules, related to an "array overflow."

Description

Specific affected release information can be found from RealNetworks at: http://service.real.com/realplayer/security/01192010_player/en/

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2010-0178

Type: Advisory; Patch Information

Hyperlink:http://www.vupen.com/english/advisories/2010/0178

External Source: CONFIRM

Name: http://service.real.com/realplayer/security/01192010_player/en/

Type: Advisory; Patch Information

Hyperlink:http://service.real.com/realplayer/security/01192010_player/en/

External Source: SECTRACK

Name: 1023489

Type: Patch Information

Hyperlink:http://securitytracker.com/id?1023489

External Source: CONFIRM

Name: https://helixcommunity.org/viewcvs/protocol/rtsp/rtspclnt.cpp?view=log#rev1.245

Hyperlink:https://helixcommunity.org/viewcvs/protocol/rtsp/rtspclnt.cpp?view=log#rev1.245

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=561338

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=561338

External Source: XF

Name: realplayer-rulebook-overflow(55802)

Hyperlink:http://xforce.iss.net/xforce/xfdb/55802

External Source: BID

Name: 37880

Hyperlink:http://www.securityfocus.com/bid/37880

External Source: REDHAT

Name: RHSA-2010:0094

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0094.html

External Source: SECUNIA

Name: 38450

Type: Advisory

Hyperlink:http://secunia.com/advisories/38450

External Source: SECUNIA

Name: 38218

Type: Advisory

Hyperlink:http://secunia.com/advisories/38218

External Source: OVAL

Name: oval:org.mitre.oval:def:10677

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10677

External Source: MLIST

Name: [protocol-cvs] 20090828 rtsp rtspclnt.cpp,1.244,1.245

Hyperlink:http://lists.helixcommunity.org/pipermail/protocol-cvs/2009-August/001943.html

External Source: MLIST

Name: [helix-client-dev] 20090828 CR: 249097 - Security fix - urgent CR requested

Hyperlink:http://lists.helixcommunity.org/pipermail/helix-client-dev/2009-August/008092.html

References to Check Content

Identifier:oval:org.mitre.oval:def:10677

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10677