Multiple RealPlayer ActiveX controls fail to properly handle properties, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.
RealNetworks RealPlayer provides multiple ActiveX controls to allow integration with Internet Explorer. The ActiveX controls provided by the file rmoc3260.dll fail to properly handle multiple properties, including Console. Setting these properties can result in heap memory corruption.
By convincing a user to view a specially crafted HTML document (e.g., a web page or an HTML email message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user.
Apply an update
This issue is addressed in RealPlayer 11.0.3. Please see the RealPlayer security update for more details.
This vulnerability was publicly disclosed by Elazar Broad.
This document was written by Will Dormann.
|Date First Published:||2008-03-11|
|Date Last Updated:||2008-07-26 22:02 UTC|