HTTP: RealNetworks RealPlayer MP3 Files Processing Buffer Overflow

This signature detects attempts to exploit a known remote buffer overflow vulnerability in RealNetworks RealPlayer application. It is due to boundary errors when processing Lyrics3 v2.00 tags in MP3 files. A remote attacker can exploit this by enticing the target user to open a crafted MP3 file. A successful attack causes a heap-based buffer overflow that can lead to arbitrary code execution in the security context of the logged in user. The behavior of the target is entirely dependent on the intended function of the injected code. In an unsuccessful attack, the affected RealPlayer or RealOne Player process terminates abnormally.

Extended Description

RealNetworks RealPlayer is prone to multiple memory-corruption vulnerabilities that arise when the application processes specially crafted files. Successfully exploiting these issues will allow remote attackers to execute arbitrary code within the context of the affected application. Failed exploit attempts will cause a denial-of-service condition.

Affected Products

Real_networks realone_player

References

BugTraq: 26214

CVE: CVE-2007-5080

Short Name

HTTP:STC:STREAM:REALPLAYER-MP3

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: RealNetworks RealPlayer MP3 Files Processing Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?