RealNetworks RealPlayer Cross-Zone Scripting Remote Code Execution VulnerabilityZDI-10-275: December 10th, 2010
TippingPoint™ IPS Customer ProtectionTippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 10589. For further product information on the TippingPoint IPS:
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. User interaction is requires in that a target must navigate to a malicious page.
The specific flaw exists within the HandleAction method of the RealPlayer ActiveX control with CLSID FDC7A535-4070-4B92-A0EA-D9994BCC0DC5. The vulnerable action that can be invoked via this control is NavigateToURL. If NavigateToURL can be pointed to a controlled file on the user's system, RealPlayer can be made to execute scripts in the Local Zone. To accomplish this, a malicious attacker can force a download of a skin file to a predictable location and then point NavigateToURL at it thus achieving remote code execution under the context of the user running RealPlayer.
Vendor ResponseRealNetworks has issued an update to correct this vulnerability. More details can be found at:
2010-05-12 - Vulnerability reported to vendor
2010-12-10 - Coordinated public release of advisory
CreditThis vulnerability was discovered by: