| Vulnerability Name: | CVE-2002-1321 (CCN-10676) | ||||||||
| Assigned: | 2002-11-22 | ||||||||
| Published: | 2002-11-22 | ||||||||
| Updated: | 2017-07-11 | ||||||||
| Summary: | Multiple buffer overflows in RealOne and RealPlayer allow remote attackers to execute arbitrary code via (1) a Synchronized Multimedia Integration Language (SMIL) file with a long parameter, (2) a long long filename in a rtsp:// request, e.g. from a .m3u file, or (3) certain "Now Playing" options on a downloaded file with a long filename. | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CCN Type: NGSSoftware Insight Security Research Advisory #NISR22112002 Multiple Buffer Overruns RealOne / RealPlayer / RealOne Enterprise Source: MITRE Type: CNA CVE-2002-1321 Source: BUGTRAQ Type: UNKNOWN 20021122 Mulitple Buffer Overflow conditions in RealPlayer/RealOne (#NISR22112002) Source: CONFIRM Type: UNKNOWN http://service.real.com/help/faq/security/bufferoverrun_player.html Source: BID Type: UNKNOWN 6227 Source: CCN Type: BID-6227 RealOne Player SMIL File Heap Corruption Vulnerability Source: BID Type: UNKNOWN 6229 Source: CCN Type: BID-6229 RealPlayer Long File Name Now Playing Buffer Overflow Vulnerability Source: CCN Type: RealNetworks Support: Security Issues RealPlayer Buffer Overrun Vulnerability Source: XF Type: UNKNOWN realplayer-smil-parameter-bo(10676) Source: XF Type: UNKNOWN realplayer-rtsp-filename-bo(10677) | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| Vulnerability Name: | CVE-2002-1321 (CCN-10677) | ||||||||
| Assigned: | 2002-11-22 | ||||||||
| Published: | 2002-11-22 | ||||||||
| Updated: | 2002-11-22 | ||||||||
| Summary: | RealNetworks RealPlayer is vulnerable to a heap-based buffer overflow, caused by improper bounds of rtsp:// file name parameters. By creating a rtsp:// URL link to media file with an overly long file name parameter, a remote attacker could overflow a buffer in RealPlay.exe and execute arbitrary code on the system, once the malicious file is downloaded and selected to play. | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CCN Type: NGSSoftware Insight Security Research Advisory #NISR22112002 Multiple Buffer Overruns RealOne / RealPlayer / RealOne Enterprise Source: MITRE Type: CNA CVE-2002-1321 Source: CCN Type: BID-6227 RealOne Player SMIL File Heap Corruption Vulnerability Source: CCN Type: BID-6229 RealPlayer Long File Name Now Playing Buffer Overflow Vulnerability Source: CCN Type: RealNetworks Support: Security Issues RealPlayer Buffer Overrun Vulnerability Source: XF Type: UNKNOWN realplayer-rtsp-filename-bo(10677) | ||||||||
| Vulnerability Name: | CVE-2002-1321 (CCN-10678) | ||||||||
| Assigned: | 2002-11-22 | ||||||||
| Published: | 2002-11-22 | ||||||||
| Updated: | 2002-11-22 | ||||||||
| Summary: | RealNetworks RealPlayer is vulnerable to a stack-based buffer overflow, caused by improper bounds of file name parameters. By creating a rtsp:// or http:// URL link to media file with an overly long file name parameter, a remote attacker could overflow a buffer and execute arbitrary code on the system, once the malicious file has been downloaded and either the "Edit Clip Info" or the "Select copy to my Library" option is selected while the file is playing. | ||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: CCN Type: NGSSoftware Insight Security Research Advisory #NISR22112002 Multiple Buffer Overruns RealOne / RealPlayer / RealOne Enterprise Source: MITRE Type: CNA CVE-2002-1321 Source: CCN Type: BID-6227 RealOne Player SMIL File Heap Corruption Vulnerability Source: CCN Type: BID-6229 RealPlayer Long File Name Now Playing Buffer Overflow Vulnerability Source: CCN Type: BID-6230 RealPlayer RealFlash Source Loading Buffer Overflow Vulnerability Source: CCN Type: RealNetworks Support: Security Issues RealPlayer Buffer Overrun Vulnerability Source: XF Type: UNKNOWN realplayer-filename-playing-bo(10678) | ||||||||
| BACK | |||||||||