CVE-2011-2950

Related Files

RealNetworks Realplayer QCP Parsing Heap Overflow

Posted Sep 17, 2011

Authored by Sean de Regge, juan vazquez | Site metasploit.com

This Metasploit module exploits a heap overflow in Realplayer when handling a .QCP file. The specific flaw exists within qcpfformat.dll. A static 256 byte buffer is allocated on the heap and user-supplied data from the file is copied within a memory copy loop. This allows a remote attacker to execute arbitrary code running in the context of the web browser via a .QCP file with a specially crafted "fmt" chunk. At this moment this module exploits the flaw on Windows XP IE6, IE7.

tags | exploit, remote, web, overflow, arbitrary

systems | windows

advisories | CVE-2011-2950, OSVDB-74549

SHA-256 | cce2bc3fede3c402a04087782f79fa183476cf2dbb4148275dc851a1d3272199

Download | Favorite | View

Zero Day Initiative Advisory 11-265

Posted Aug 17, 2011

Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 11-265 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of RealNetworks RealPlayer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within qcpfformat.dll, which is responsible for parsing QCP media files. The process creates a static 256 byte allocation on the heap and trusts a user-supplied counter from the file within a memory copy loop. As the source data is also user-supplied from the file, this can be abused by a remote attacker to execute arbitrary code running in the context of the web browser.

tags | advisory, remote, web, arbitrary

advisories | CVE-2011-2950

SHA-256 | b7524be329d663793a9abbc11c46bee42745e99635cdcb27b6bb37952693a381

Download | Favorite | View