Lucene search

[email protected]CVE-2013-2603

HistoryJan 12, 2015 - 7:59 p.m.

CVE-2013-2603

2015-01-1219:59:00

[email protected]

web.nvd.nist.gov

cve-2013-2603

racinstaller.statectrl.1

remote code execution

activex

realnetworks gamehouse

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

8.1 High

AI Score

Confidence

High

0.043 Low

EPSS

Percentile

92.4%

JSON

The RACInstaller.StateCtrl.1 ActiveX control in InstallerDlg.dll in RealNetworks GameHouse RealArcade Installer 2.6.0.481 performs unexpected type conversions for invalid parameter types, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted arguments to the (1) AddTag, (2) Ping, (3) QueuePause, (4) QueueRemove, (5) QueueTop, (6) RemoveTag, (7) TagRemoved, or (8) message method.

Affected configurations

NVD

Node

realnetworksrealarcade_installerMatch2.6.0.481

CPENameOperatorVersion
realnetworks:realarcade_installerrealnetworks realarcade installereq2.6.0.481

CPE	Name	Operator	Version
realnetworks:realarcade_installer	realnetworks realarcade installer	eq	2.6.0.481

References

www.osvdb.org/96919

www.riskbasedsecurity.com/reports/RBS-GameHouseAnalysis-Sept2013.pdf

www.riskbasedsecurity.com/research/RBS-2013-006.pdf

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

8.1 High

AI Score

Confidence

High

0.043 Low

EPSS

Percentile

92.4%

JSON

Related for CVE-2013-2603

prion1 nvd1 cvelist1