CVE-2003-0726 RealOne player allows remote attackers to execute arbitrary script in the "My Computer" zone via a SMIL presentation with a URL that references a scripting protocol, which is executed in the security....
MediumCVSS 5.1
EPSS 6.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
RealOne player allows remote attackers to execute arbitrary script in the "My Computer" zone via a SMIL presentation with a URL that references a scripting protocol, which is executed in the security context of the previously loaded URL, as demonstrated using a "javascript:" URL in the area tag.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| realnetworks realone desktop manager | All versions | No fix listed |
| realnetworks realone enterprise desktop | = 6.0.11.774 | No fix listed |
| realnetworks realone player | = 2.0 | No fix listed |
| realnetworks realone player | = 6.0.10.505-gold | No fix listed |
| realnetworks realone player | = 6.0.11.818 | No fix listed |
| realnetworks realone player | = 6.0.11.830 | No fix listed |
| realnetworks realone player | = 6.0.11.841 | No fix listed |
| realnetworks realone player | = 6.0.11.853 | No fix listed |
References
- 1007532 vdb-entry
- www.digitalpranksters.com exploit patch url-repurposed vendor-advisory
- 20030827 RealOne Player Allows Cross Zone and Domain Access exploit mailing-list vendor-advisory
- 8453 exploit patch vdb-entry vendor-advisory
- www.service.real.com
- realone-smil-execute-code(13028) vdb-entry