#VU41657 Code Injection in RealPlayer - CVE-2014-3444

Vulnerability identifier: #VU41657

Vulnerability risk: High

CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2014-3444

CWE-ID: CWE-94

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
RealPlayer
Client/Desktop applications / Multimedia software

Vendor: RealNetworks

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The GetGUID function in codecs/dmp4.dll in RealNetworks RealPlayer 16.0.3.51 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (write access violation and application crash) via a malformed .3gp file.

Mitigation
Install update from vendor's website.

Vulnerable software versions

RealPlayer: 16.0.0 - 16.0.2.32

---

External links
https://packetstormsecurity.com/files/126637

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.