Vulnerability CVE-2011-2955 - CERT Civis.Net

Vulnerability Name:

CVE-2011-2955 (CCN-69273)

Assigned:

2011-08-16

Published:

2011-08-16

Updated:

2011-10-06

Summary:

Use-after-free vulnerability in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and RealPlayer Enterprise 2.0 through 2.1.5, when an Embedded RealPlayer is used, allows remote attackers to execute arbitrary code via vectors related to a modal dialog.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2011-2955

Source: CCN
Type: SA44014
RealPlayer Multiple Vulnerabilities

Source: CCN
Type: SA45608
RealPlayer Enterprise Multiple Vulnerabilities

Source: CCN
Type: RealNetworks August 2011 Update
RealNetworks, Inc. Releases Update to Address Security Vulnerabilities

Source: CONFIRM
Type: Vendor Advisory
http://service.real.com/realplayer/security/08162011_player/en/

Source: CCN
Type: OSVDB ID: 74555
RealPlayer ActiveX Control Embedded Modal Dialog Unspecified Use-after-free Issue

Source: CCN
Type: BID-49198
Real Networks RealPlayer (CVE-2011-2955) Use After Free Memory Corruption Vulnerability

Source: SECTRACK
Type: UNKNOWN
1025943

Source: XF
Type: UNKNOWN
realplayer-modal-dialog-code-execution(69273)

Vulnerable Configuration:

Configuration 1:

cpe:/a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:realnetworks:realplayer:14.0.0:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:14.0.1:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:14.0.2:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:14.0.3:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:14.0.4:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:14.0.5:*:*:*:*:*:*:*

Configuration 3:

cpe:/a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer_sp:1.1.5:*:*:*:*:*:*:*

Configuration 4:

cpe:/a:realnetworks:realplayer:2.0:*:enterprise:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:2.1:*:enterprise:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:2.1.2:*:enterprise:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:2.1.3:*:enterprise:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:2.1.4:*:enterprise:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:2.1.5:*:enterprise:*:*:*:*:*

Configuration CCN 1:

cpe:/a:realnetworks:realplayer:14.0.0:*:*:*:*:*:*:*

OR cpe:/a:realnetworks:realplayer:14.0.5:*:*:*:*:*:*:*

Denotes that component is vulnerable