HTTP: RealNetworks RealPlayer QCP Parsing Buffer Overflow

This signature detects attempts to exploit a known vulnerability in RealNetworks RealPlayer. The vulnerability is due to insufficient bounds checking while copying user-supplied data into a fixed-length buffer. This can lead to a buffer overflow and subsequent memory corruption. A remote attacker can exploit this vulnerability by enticing a user to download and process a malicious QCP file with a vulnerable version of the application. A successful attack would result in the execution of attacker-controlled code in the security context of the current user.

Extended Description

Real Networks RealPlayer is prone to a remote code-execution vulnerability. Successful exploits will allow remote attackers to execute arbitrary code within the context of the affected application. Failed attacks may cause denial-of-service conditions. Versions prior to RealPlayer for Windows 14.0.6 are vulnerable. NOTE: This issue was previously discussed in BID 49169 (Real Networks RealPlayer Multiple Remote Vulnerabilities) but has been given its own record to better document it.

Affected Products

Real_networks realplayer_sp

References

BugTraq: 49172

CVE: CVE-2011-2950

URL: http://service.real.com/realplayer/security/08162011_player/en/ http://www.zerodayinitiative.com/advisories/zdi-11-265/

Short Name

HTTP:STC:STREAM:REALPLAYER-QCP

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: RealNetworks RealPlayer QCP Parsing Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?