CVE-2009-4257
RealNetworks RealPlayer SMIL getAtom Remote Code Execution Vulnerability
Severity Score
9.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Heap-based buffer overflow in datatype/smil/common/smlpkt.cpp in smlrender.dll in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10 and 11.0.0, and Helix Player 10.x and 11.0.0 allows remote attackers to execute arbitrary code via an SMIL file with crafted string lengths.
Un desbordamiento de búfer en la región heap de la memoria en el archivo datatype/smil/common/smlpkt.cpp en la biblioteca smlrender. dll en RealPlayer versión 10, RealPlayer versiones 10.5 6.0.12.1040 hasta 6.0.12.1741, RealPlayer versiones 11 11.0.0 hasta 11.0.4, RealPlayer Enterprise, Mac RealPlayer versiones 10 y 10.1, Linux RealPlayer versiones 10 y 11.0.0 y Helix Player versiones 10.x y 11.0.0, de RealNetworks, permite a los atacantes remotos ejecutar código arbitrario por medio de un archivo SMIL con longitudes de cadena especialmente diseñadas.
This vulnerability allows attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the smlrender.dll library responsible for parsing SMIL files. A lack of proper string length checks can result in the overflow of a static heap buffer. Exploitation of this overflow can lead to arbitrary code execution under the context of the user running the process.
*Credits:
Anonymous
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2009-12-09 CVE Reserved
- 2010-01-21 CVE Published
- 2024-07-25 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-122: Heap-based Buffer Overflow
CAPEC
References (15)
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://securitytracker.com/id?1023489 | 2018-10-10 | |
| http://service.real.com/realplayer/security/01192010_player/en | 2018-10-10 | |
| http://www.vupen.com/english/advisories/2010/0178 | 2018-10-10 | |
| http://www.zerodayinitiative.com/advisories/ZDI-10-007 | 2018-10-10 |
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/38218 | 2018-10-10 | |
| http://secunia.com/advisories/38450 | 2018-10-10 | |
| http://www.redhat.com/support/errata/RHSA-2010-0094.html | 2018-10-10 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=561309 | 2010-02-09 | |
| https://access.redhat.com/security/cve/CVE-2009-4257 | 2010-02-09 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Realnetworks Search vendor "Realnetworks" | Realplayer Search vendor "Realnetworks" for product "Realplayer" | 10.0 Search vendor "Realnetworks" for product "Realplayer" and version "10.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | * | - |
Safe
|
| Realnetworks Search vendor "Realnetworks" | Realplayer Search vendor "Realnetworks" for product "Realplayer" | 10.5 Search vendor "Realnetworks" for product "Realplayer" and version "10.5" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | * | - |
Safe
|
| Realnetworks Search vendor "Realnetworks" | Realplayer Search vendor "Realnetworks" for product "Realplayer" | 11.0 Search vendor "Realnetworks" for product "Realplayer" and version "11.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | * | - |
Safe
|
| Realnetworks Search vendor "Realnetworks" | Realplayer Search vendor "Realnetworks" for product "Realplayer" | 11.0.1 Search vendor "Realnetworks" for product "Realplayer" and version "11.0.1" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | * | - |
Safe
|
| Realnetworks Search vendor "Realnetworks" | Realplayer Search vendor "Realnetworks" for product "Realplayer" | 11.0.2 Search vendor "Realnetworks" for product "Realplayer" and version "11.0.2" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | * | - |
Safe
|
| Realnetworks Search vendor "Realnetworks" | Realplayer Search vendor "Realnetworks" for product "Realplayer" | 11.0.3 Search vendor "Realnetworks" for product "Realplayer" and version "11.0.3" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | * | - |
Safe
|
| Realnetworks Search vendor "Realnetworks" | Realplayer Search vendor "Realnetworks" for product "Realplayer" | 11.0.4 Search vendor "Realnetworks" for product "Realplayer" and version "11.0.4" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | * | - |
Safe
|
| Realnetworks Search vendor "Realnetworks" | Realplayer Search vendor "Realnetworks" for product "Realplayer" | 11.0.5 Search vendor "Realnetworks" for product "Realplayer" and version "11.0.5" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | * | - |
Safe
|
| Realnetworks Search vendor "Realnetworks" | Realplayer Enterprise Search vendor "Realnetworks" for product "Realplayer Enterprise" | * | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | * | - |
Safe
|
| Realnetworks Search vendor "Realnetworks" | Realplayer Sp Search vendor "Realnetworks" for product "Realplayer Sp" | 1.0.0 Search vendor "Realnetworks" for product "Realplayer Sp" and version "1.0.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | * | - |
Safe
|
| Realnetworks Search vendor "Realnetworks" | Realplayer Sp Search vendor "Realnetworks" for product "Realplayer Sp" | 1.0.1 Search vendor "Realnetworks" for product "Realplayer Sp" and version "1.0.1" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | * | - |
Safe
|
| Realnetworks Search vendor "Realnetworks" | Realplayer Search vendor "Realnetworks" for product "Realplayer" | 10.0 Search vendor "Realnetworks" for product "Realplayer" and version "10.0" | - |
Affected
| in | Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | * | - |
Safe
|
| Realnetworks Search vendor "Realnetworks" | Realplayer Search vendor "Realnetworks" for product "Realplayer" | 10.1 Search vendor "Realnetworks" for product "Realplayer" and version "10.1" | - |
Affected
| in | Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | * | - |
Safe
|
| Realnetworks Search vendor "Realnetworks" | Realplayer Search vendor "Realnetworks" for product "Realplayer" | 11.0 Search vendor "Realnetworks" for product "Realplayer" and version "11.0" | - |
Affected
| in | Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | * | - |
Safe
|
| Realnetworks Search vendor "Realnetworks" | Realplayer Search vendor "Realnetworks" for product "Realplayer" | 11.0.1 Search vendor "Realnetworks" for product "Realplayer" and version "11.0.1" | - |
Affected
| in | Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | * | - |
Safe
|
| Realnetworks Search vendor "Realnetworks" | Helix Player Search vendor "Realnetworks" for product "Helix Player" | 10.0 Search vendor "Realnetworks" for product "Helix Player" and version "10.0" | - |
Affected
| ||||||
| Realnetworks Search vendor "Realnetworks" | Helix Player Search vendor "Realnetworks" for product "Helix Player" | 11.0.0 Search vendor "Realnetworks" for product "Helix Player" and version "11.0.0" | - |
Affected
| ||||||
| Realnetworks Search vendor "Realnetworks" | Helix Player Search vendor "Realnetworks" for product "Helix Player" | 11.0.1 Search vendor "Realnetworks" for product "Helix Player" and version "11.0.1" | - |
Affected
| ||||||
| Realnetworks Search vendor "Realnetworks" | Realplayer Search vendor "Realnetworks" for product "Realplayer" | 10.0 Search vendor "Realnetworks" for product "Realplayer" and version "10.0" | linux |
Affected
| ||||||
| Realnetworks Search vendor "Realnetworks" | Realplayer Search vendor "Realnetworks" for product "Realplayer" | 11.0.0 Search vendor "Realnetworks" for product "Realplayer" and version "11.0.0" | linux |
Affected
| ||||||
| Realnetworks Search vendor "Realnetworks" | Realplayer Search vendor "Realnetworks" for product "Realplayer" | 11.0.1 Search vendor "Realnetworks" for product "Realplayer" and version "11.0.1" | linux |
Affected
| ||||||