nvd-json-data-feeds/CVE-2007/CVE-2007-56xx/CVE-2007-5601.json

{
  "id": "CVE-2007-5601",
  "sourceIdentifier": "cret@cert.org",
  "published": "2007-10-20T20:17:00.000",
  "lastModified": "2017-07-29T01:33:45.443",
  "vulnStatus": "Modified",
  "descriptions": [
    {
      "lang": "en",
      "value": "Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions including 10, RealOne Player, and RealOne Player 2, allows remote attackers to execute arbitrary code via certain playlist names, as demonstrated via the import method to the IERPCtl ActiveX control in ierpplug.dll."
    },
    {
      "lang": "es",
      "value": "Un desbordamiento de b\u00fafer en la regi\u00f3n stack de la memoria en el Database Component en la biblioteca MPAMedia.dll en RealNetworks RealPlayer versiones 10.5 y 11 beta, y anteriores, incluyendo versi\u00f3n 10, RealOne Player y RealOne Player versi\u00f3n 2, permite a atacantes remotos ejecutar c\u00f3digo arbitrario por medio de ciertos nombres de lista de reproducci\u00f3n, como es demostrado por medio del m\u00e9todo import en el control ActiveX IERPCtl en la biblioteca ierpplug.dl."
    }
  ],
  "vendorComments": [
    {
      "organization": "Red Hat",
      "comment": "Not vulnerable. This issue did not affect versions of RealPlayer as shipped with Red Hat Enterprise Linux 3 and 4 Extras or with Red Hat Enterprise Linux 5 Supplementary.",
      "lastModified": "2007-10-23T00:00:00"
    }
  ],
  "metrics": {
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "accessVector": "NETWORK",
          "accessComplexity": "MEDIUM",
          "authentication": "NONE",
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3
        },
        "baseSeverity": "HIGH",
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD49D16C-B0AC-4228-9984-010661596232"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "348F3214-E5C2-4D39-916F-1B0263D13F40"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:realnetworks:realplayer:11_beta:*:*:*:*:*:*:*",
              "matchCriteriaId": "64C3CD7C-9CD8-4BC3-9ECE-CE39FB02E602"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://service.real.com/realplayer/security/191007_player/en/",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.infosecblog.org/2007/10/nasa-bans-ie.html",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/871673",
      "source": "cret@cert.org",
      "tags": [
        "US Government Resource"
      ]
    },
    {
      "url": "http://www.securityfocus.com/bid/26130",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securitytracker.com/id?1018843",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.symantec.com/enterprise/security_response/weblog/2007/10/realplayer_exploit_on_the_loos.html",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA07-297A.html",
      "source": "cret@cert.org",
      "tags": [
        "US Government Resource"
      ]
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/3548",
      "source": "cret@cert.org",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37280",
      "source": "cret@cert.org"
    }
  ]
}