RealPlayer malformed IVR object index Code Execution Vulnerability and repair

Affected Versions:

Real Networks RealPlayer 11.0-11.1

Vulnerability description:

Cve id: The CVE-2010-2996RealPlayer is a popular multimedia player. When resolving RealMedia. IVR files containing malformed data headers, RealPlayer mistakenly trusts the indexes in the data structure to find

Object List. If the attacker specifies an index outside the array boundary, the application will reference the object from the computed pointer and call it.

Attackers can execute arbitrary code.

<* Reference

Http://marc.info /? L = bugtraq & m = 128284984510070 & w = 2

*>

Vendor patch: Real Networks ------------- the current vendor has released the upgrade patch to fix this security problem, please download to the vendor's home page: http://service.real.com/realplayer/security/08262010_player/en/