RealPlayer and RealOne Player include a number of ActiveX controls allowing functions to be called by scripts embedded in web pages.
CDDA (cdda://) is a protocol used to locate media files on Compact Disc Digital Audio. The
**Source** property of the ActiveX control with
**rmocx.RealPlayer G2 Control.1** in
**rmoc3260.dll** is used to specify the URI of the location of a media file via URIs based on
**http:** protocols, not
**cdda:**. By setting the
**Source** property to a CDDA URI, an attacker can cause code to be executed from an uninitialized pointer, and a long enough CDDA URI can control the value of the uninitialized pointer, thereby allowing remote code execution in the security context of the currently logged on user.
See the RealNetworks advisory for fix information.
Exploit works on RealNetworks Realplayer 11.1.1 and requires the user to open the exploit page using Internet Explorer 6 or 7.