Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2010.0140
Critical: HelixPlayer security update
10 February 2010
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: HelixPlayer
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux AS/ES/WS 4
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2010-0417 CVE-2010-0416 CVE-2009-4257
CVE-2009-4248 CVE-2009-4247 CVE-2009-4245
CVE-2009-4242
Reference: ASB-2010.0020
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2010-0094.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: HelixPlayer security update
Advisory ID: RHSA-2010:0094-02
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2010-0094.html
Issue date: 2010-02-09
CVE Names: CVE-2009-4242 CVE-2009-4245 CVE-2009-4247
CVE-2009-4248 CVE-2009-4257 CVE-2010-0416
CVE-2010-0417
=====================================================================
1. Summary:
An updated HelixPlayer package that fixes several security issues is now
available for Red Hat Enterprise Linux 4.
This update has been rated as having critical security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 4 - i386, ppc, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, x86_64
Red Hat Enterprise Linux WS version 4 - i386, x86_64
3. Description:
HelixPlayer is a media player.
Multiple buffer and integer overflow flaws were found in the way
HelixPlayer processed Graphics Interchange Format (GIF) files. An attacker
could create a specially-crafted GIF file which would cause HelixPlayer to
crash or, potentially, execute arbitrary code when opened. (CVE-2009-4242,
CVE-2009-4245)
A buffer overflow flaw was found in the way HelixPlayer processed
Synchronized Multimedia Integration Language (SMIL) files. An attacker
could create a specially-crafted SMIL file which would cause HelixPlayer to
crash or, potentially, execute arbitrary code when opened. (CVE-2009-4257)
A buffer overflow flaw was found in the way HelixPlayer handled the Real
Time Streaming Protocol (RTSP) SET_PARAMETER directive. A malicious RTSP
server could use this flaw to crash HelixPlayer or, potentially, execute
arbitrary code. (CVE-2009-4248)
Multiple buffer overflow flaws were discovered in the way HelixPlayer
handled RuleBook structures in media files and RTSP streams.
Specially-crafted input could cause HelixPlayer to crash or, potentially,
execute arbitrary code. (CVE-2009-4247, CVE-2010-0417)
A buffer overflow flaw was found in the way HelixPlayer performed URL
un-escaping. A specially-crafted URL string could cause HelixPlayer to
crash or, potentially, execute arbitrary code. (CVE-2010-0416)
All HelixPlayer users are advised to upgrade to this updated package,
which contains backported patches to resolve these issues. All running
instances of HelixPlayer must be restarted for this update to take effect.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
561309 - CVE-2009-4257 HelixPlayer / RealPlayer: SMIL getAtom heap buffer overflow
561338 - CVE-2009-4247 HelixPlayer / RealPlayer: RTSP client ASM RuleBook stack buffer overflow
561361 - CVE-2009-4248 HelixPlayer / RealPlayer: RTSP SET_PARAMETER buffer overflow
561436 - CVE-2009-4242 HelixPlayer / RealPlayer: GIF file heap overflow
561441 - CVE-2009-4245 HelixPlayer / RealPlayer: compressed GIF heap overflow
561856 - CVE-2010-0416 HelixPlayer / RealPlayer: URL unescape buffer overflow
561860 - CVE-2010-0417 HelixPlayer / RealPlayer: rule book handling heap corruption
6. Package List:
Red Hat Enterprise Linux AS version 4:
Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/HelixPlayer-1.0.6-1.el4_8.1.src.rpm
i386:
HelixPlayer-1.0.6-1.el4_8.1.i386.rpm
HelixPlayer-debuginfo-1.0.6-1.el4_8.1.i386.rpm
ppc:
HelixPlayer-1.0.6-1.el4_8.1.ppc.rpm
HelixPlayer-debuginfo-1.0.6-1.el4_8.1.ppc.rpm
x86_64:
HelixPlayer-1.0.6-1.el4_8.1.i386.rpm
HelixPlayer-debuginfo-1.0.6-1.el4_8.1.i386.rpm
Red Hat Enterprise Linux Desktop version 4:
Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/HelixPlayer-1.0.6-1.el4_8.1.src.rpm
i386:
HelixPlayer-1.0.6-1.el4_8.1.i386.rpm
HelixPlayer-debuginfo-1.0.6-1.el4_8.1.i386.rpm
x86_64:
HelixPlayer-1.0.6-1.el4_8.1.i386.rpm
HelixPlayer-debuginfo-1.0.6-1.el4_8.1.i386.rpm
Red Hat Enterprise Linux ES version 4:
Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/HelixPlayer-1.0.6-1.el4_8.1.src.rpm
i386:
HelixPlayer-1.0.6-1.el4_8.1.i386.rpm
HelixPlayer-debuginfo-1.0.6-1.el4_8.1.i386.rpm
x86_64:
HelixPlayer-1.0.6-1.el4_8.1.i386.rpm
HelixPlayer-debuginfo-1.0.6-1.el4_8.1.i386.rpm
Red Hat Enterprise Linux WS version 4:
Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/HelixPlayer-1.0.6-1.el4_8.1.src.rpm
i386:
HelixPlayer-1.0.6-1.el4_8.1.i386.rpm
HelixPlayer-debuginfo-1.0.6-1.el4_8.1.i386.rpm
x86_64:
HelixPlayer-1.0.6-1.el4_8.1.i386.rpm
HelixPlayer-debuginfo-1.0.6-1.el4_8.1.i386.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2009-4242.html
https://www.redhat.com/security/data/cve/CVE-2009-4245.html
https://www.redhat.com/security/data/cve/CVE-2009-4247.html
https://www.redhat.com/security/data/cve/CVE-2009-4248.html
https://www.redhat.com/security/data/cve/CVE-2009-4257.html
https://www.redhat.com/security/data/cve/CVE-2010-0416.html
https://www.redhat.com/security/data/cve/CVE-2010-0417.html
http://www.redhat.com/security/updates/classification/#critical
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2010 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFLcVKPXlSAg2UNWIIRApF/AJ4mxI3h10RmeTfe9RzhdKLqnafovgCgrXHL
fxM/iR0MhnxUeplkePoBuKU=
=jjci
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iD8DBQFLcksV/iFOrG6YcBERAiw5AKCtNT3ttkusSm0IbxYkCwHFSPyI7wCgy3zv
Q/g7R7cDP7BIx+SXrbIOzhc=
=Qy3p
-----END PGP SIGNATURE-----