Signature Detail

APP: RealPlayer Malicious Skin Download

This signature detects attempts to exploit a known vulnerability against RealPlayer. Attackers can craft a malicious skin file, which if a user downloads, allows the attacker to execute arbitrary code in the context of the user.

Extended Description

DynaZip is susceptible to a stack-based buffer-overflow vulnerability. This issue is due to the library's failure to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer. A remote attacker may exploit this vulnerability to execute arbitrary instructions in the context of an application that uses the affected library. The following applications are known to include vulnerable versions of the affected library: - RealPlayer for Microsoft Windows - RealOne Player for Microsoft Windows - CheckMark Payroll 2004/2005. Other applications also likely include the vulnerable library.

Affected Products

• Checkmark_software_inc. checkmark_payroll 3.9.1
• Checkmark_software_inc. checkmark_payroll 3.9.2
• Checkmark_software_inc. checkmark_payroll 3.9.3
• Checkmark_software_inc. checkmark_payroll 3.9.4
• Checkmark_software_inc. checkmark_payroll 3.9.5
• Checkmark_software_inc. checkmark_payroll 3.9.6
• Checkmark_software_inc. multiledger 6.0.3
• Checkmark_software_inc. multiledger 7.0.0
• Dtsearch_corp dtsearch 5.25.0
• Dtsearch_corp dtsearch 6.5.0 Build 6608
• Dtsearch_corp dtsearch_with_spider 7.10.0 Build 7045
• Dtsearch_corp dtsearch_with_spider
• Ibm lotus_notes 6.5.0
• Ibm lotus_notes 6.5.1
• Ibm lotus_notes 6.5.2
• Ibm lotus_notes 6.5.3
• Ibm lotus_notes 6.5.4
• Innermedia dynazip_library 3.0.0 .0.14
• Innermedia dynazip_library 5.00.00
• Innermedia dynazip_library 5.00.01
• Innermedia dynazip_library 5.00.02
• Innermedia dynazip_library 5.00.03
• Mcafee securitycenter_agent 6.0.0.16
• Mcafee virusscan 10.0.21
• Real_networks realone_player 1.0.0
• Real_networks realone_player 2.0.0
• Real_networks realplayer 10.0.0
• Real_networks realplayer 10.0.0 BETA
• Real_networks realplayer 10.0.0 v6.0.12.690
• Real_networks realplayer 10.5.0
• Real_networks realplayer 10.5.0 Beta v6.0.12.1016
• Real_networks realplayer 10.5.0 V6.0.12.1040
• Real_networks realplayer 10.5.0 V6.0.12.1053

References

• BugTraq: 11555
• BugTraq: 15382
• CVE: CVE-2004-1094
• CVE: CVE-2005-2630
• URL: http://www.securitytracker.com/alerts/2004/Oct/1011944.html
• URL: http://service.real.com/help/faq/security/041026_player/EN/