Helix Player SMIL wallclock Remote Buffer Overflow Vulnerability

Release Date:	27/06/2007	Severity:	Highly Critical
SecWatch Advisory:	SWID1018306	Cause:	Boundary error
Solution Status:	Vendor Patch	Impact:	Execution of arbitrary code
Exploit Status:	None Available	Access Vector:	From remote

Affected Software:	Helix Player 1.x RealPlayer 10.x

Description:

A vulnerability in RealPlayer and Helix Player has been reported, which can be exploited by remote users to compromise a user's system.

The vulnerability is due to a boundary error when handling time formats the in "SmilTimeValue::parseWallClockValue()" function, which can be exploited to cause a stack-based buffer overflow via an SMIL file with an overly long, specially-crafted time string.

Affected:

RealNetworks RealPlayer versions 10.x
Helix Player versions 1.x

Solution:

The vulnerability has been fixed in the latest version:
http://www.real.com/realplayer.html

Credits:

iDEFENSE