Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security VulnWatch
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[VulnWatch] RealOne Player / Real .WAV Heap Overflow File Format Vulnera

from [Mark Litchfield] Network Security [Permanent Link]
Subject: [VulnWatch] RealOne Player / Real .WAV Heap Overflow File Format Vulnerability
Date: Wed, 2 Mar 2005 11:19:41 -0000 
Mark Litchfield of NGSSoftware has discovered a high risk Heap Overflow
vulnerability in the .WAV file format when being opened by either of the
following products:

Windows:
 
RealPlayer 10.5 (6.0.12.1056 and below)
RealPlayer 10 
RealOne Player V2 
RealOne Player V1 
RealPlayer 8 
RealPlayer Enterprise 

Linux:
RealPlayer 10 (10.0.0.2 and below)
Helix Player

This issue has been resolved in the latest version as detailed at :

http://service.real.com/realplayer/security/

It can be downloaded from:

http://service.real.com/help/faq/security/050224_player

Or alternatively select Tools / Check For Update from within the media
player.

NGSSoftware are going to withhold details of this flaw for three months.
Full details 
will be published on the 1st of June 2005. This three month window will
allow users of 
the above Real products the time needed to apply the patch before the
details are released to the general 
public. This reflects NGSSoftware's approach to responsible disclosure.


NGSSoftware Insight Security Research
http://www.ngssoftware.com
http://www.databasesecurity.com/
+44(0)208 401 0070
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • [VulnWatch] RealOne Player / Real .WAV Heap Overflow File Format Vulnerability, Mark Litchfield <=
Previous by Date:  [VulnWatch] iDEFENSE Security Advisory 03.01.05: RealNetworks RealPlayer .smil Buffer Overflow Vulnerability, Michael Sutton
Next by Date:  iDEFENSE Security Advisory 03.02.05: Computer Associates License Client/Server GCR Checksum Buffer Overflow, iDEFENSE Labs
Previous by Thread:  [VulnWatch] iDEFENSE Security Advisory 03.01.05: RealNetworks RealPlayer .smil Buffer Overflow Vulnerability, Michael Sutton
Next by Thread:  iDEFENSE Security Advisory 03.02.05: Computer Associates License Client/Server GCR Checksum Buffer Overflow, iDEFENSE Labs
Indexes:  [Date] [Thread] [Top] [All Lists]