1. CVE-Search
  2. CVE-2011-0694
ID CVE-2011-0694
Summary RealNetworks RealPlayer 11.0 through 11.1, SP 1.0 through 1.1.5, and 14.0.0 through 14.0.1, and Enterprise 2.0 through 2.1.4, uses predictable names for temporary files, which allows remote attackers to conduct cross-domain scripting attacks and execute arbitrary code via the OpenURLinPlayerBrowser function.
References
Vulnerable Configurations
  • cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:14.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:14.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:14.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:14.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer_sp:1.1.5:*:*:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer_sp:1.1.5:*:*:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:2.0:*:enterprise:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:2.0:*:enterprise:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:2.1:*:enterprise:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:2.1:*:enterprise:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:2.1.2:*:enterprise:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:2.1.2:*:enterprise:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:2.1.3:*:enterprise:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:2.1.3:*:enterprise:*:*:*:*:*
  • cpe:2.3:a:realnetworks:realplayer:2.1.4:*:enterprise:*:*:*:*:*
    cpe:2.3:a:realnetworks:realplayer:2.1.4:*:enterprise:*:*:*:*:*
CVSS
Base: 9.3 (as of 09-10-2018 - 19:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:C/I:C/A:C
refmap via4
bugtraq 20110208 ZDI-11-076: RealNetworks Real Player Predictable Temporary File Remote Code Execution Vulnerability
confirm
misc http://www.zerodayinitiative.com/advisories/ZDI-11-076
osvdb 70849
sectrack 1025058
secunia 43268
sreason 8098
Last major update 09-10-2018 - 19:29
Published 21-02-2011 - 18:00
Last modified 09-10-2018 - 19:29
Back to Top