Overview
Real Media Player fails to parse filenames correctly, which may allow a remote, unauthenticated attacker to execute arbitrary code in the context of the logged in user.
Description
CWE-121: Stack-based Buffer Overflow - CVE-2013-4973 Real Media Player versions prior to version 16.0.3.51 are vulnerable to a stack buffer overflow when provided with a specially crafted .rmp file. When executed, it may allow a remote unauthenticated attacker to run arbitrary code in the context of the logged in user. |
Impact
A remote unauthenticated attacker may obtain sensitive information, cause a denial of service condition, or execute arbitrary code with the privileges of the application.. |
Solution
Apply an Update |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 3.7 | AV:L/AC:H/Au:N/C:P/I:P/A:P |
| Temporal | 2.9 | E:POC/RL:OF/RC:C |
| Environmental | 0.9 | CDP:L/TD:L/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
Thanks to hamburgers maccoy for reporting this vulnerability.
This document was written by Chris King.
Other Information
| CVE IDs: | CVE-2013-4973 |
| Date Public: | 2013-08-23 |
| Date First Published: | 2013-08-26 |
| Date Last Updated: | 2013-08-26 13:38 UTC |
| Document Revision: | 24 |