-->
SecPod ID: 10221 Status: Public Report
Realtek Media Player Playlist Processing Buffer Overflow Severity: High
Vulnerability Release Date: 16-12-2008
CVSS Base Score: 9.3 (AV:N/AC:M/Au:NR/C:C/I:C/A:C)
CVSS Temporal Score = 8.4
Impact Level: Application
Affected Software/OS/Device:
- Realtek Executable 'rtlrack.exe' version 1.15.0.0 or prior.
OpenVAS Plugin ID:
Snort Signature ID:
OVAL ID:
Vulnerability Insight:
Overview:
Realtek Media Player is prone to Buffer Overflow Vulnerability.
Description:
This flaws is due to improper boundary check while processing the playlist
'pla' files which causes remote code execution.
Impact:
Successful exploitation will let the attacker execute arbitrary codes in the
context of the application and can cause stack based buffer overflow to crash
the application.
CVSS Score Report:
ACCESS_VECTOR = NETWORK
ACCESS_COMPLEXITY = MEDIUM
AUTHENTICATION = NOT_REQUIRED
CONFIDENTIALITY_IMPACT = COMPLETE
INTEGRITY_IMPACT = COMPLETE
AVAILABILITY_IMPACT = COMPLETE
EXPLOITABILITY = PROOF_OF_CONCEPT
REMEDIATION_LEVEL = UNAVAILABLE
REPORT_CONFIDENCE = CONFIRMED
CVSS Base Score = 9.3 (AV:N/AC:M/Au:NR/C:C/I:C/A:C)
CVSS Temporal Score = 8.4
Risk factor = High
Workaround
Do not open untrusted playlist 'pla' files through Realtek Media Player.
Fix:
No solution is available as of now.
References:
http://www.milw0rm.com/exploits/7492
http://secunia.com/advisories/33183