Vulnerability CVE-2011-2949 - CERT Civis.Net

Vulnerability Name:

CVE-2011-2949 (CCN-69267)

Assigned:

2011-08-16

Published:

2011-08-16

Updated:

2011-10-06

Summary:

Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.0 through 2.1.5 allows remote attackers to execute arbitrary code via crafted ID3v2 tags in an MP3 file.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2011-2949

Source: CCN
Type: SA44014
RealPlayer Multiple Vulnerabilities

Source: CCN
Type: SA45608
RealPlayer Enterprise Multiple Vulnerabilities

Source: CCN
Type: RealNetworks August 2011 Update
RealNetworks, Inc. Releases Update to Address Security Vulnerabilities

Source: CONFIRM
Type: Vendor Advisory
http://service.real.com/realplayer/security/08162011_player/en/

Source: CCN
Type: OSVDB ID: 74548
RealPlayer ID3v2 Tag MP3 File Handling Overflow

Source: CCN
Type: BID-49174
Real Networks RealPlayer (CVE-2011-2949) Remote Code Execution Vulnerability

Source: SECTRACK
Type: UNKNOWN
1025943

Source: MISC
Type: UNKNOWN
http://zerodayinitiative.com/advisories/ZDI-11-267/

Source: XF
Type: UNKNOWN
realplayer-id3v2-bo(69267)

Source: CCN
Type: ZDI-11-267
RealNetworks Realplayer MP3 ID3 tags Remote Code Execution Vulnerability

Vulnerable Configuration:

Configuration 1:

cpe:/a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:realnetworks:realplayer:14.0.0:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:14.0.1:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:14.0.2:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:14.0.3:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:14.0.4:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:14.0.5:*:*:*:*:*:*:*

Configuration 3:

cpe:/a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.1.5:*:*:*:*:*:*:*

Configuration 4:

cpe:/a:realnetworks:realplayer:2.0:*:enterprise:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:2.1.2:*:enterprise:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:2.1.3:*:enterprise:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:2.1.4:*:enterprise:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:2.1.5:*:enterprise:*:*:*:*:*

Configuration CCN 1:

cpe:/a:realnetworks:realplayer:14.0.0:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:14.0.5:*:*:*:*:*:*:*

Denotes that component is vulnerable