CVE-2010-3749

{"id": "CVE-2010-3749", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-10-19T00:00:01.533", "references": [{"url": "http://service.real.com/realplayer/security/10152010_player/en/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.exploit-db.com/exploits/15991", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/44144", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/44443", "source": "cve@mitre.org"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-10-211/", "source": "cve@mitre.org"}, {"url": "http://service.real.com/realplayer/security/10152010_player/en/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.exploit-db.com/exploits/15991", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/44144", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/44443", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-10-211/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "The browser-plugin implementation in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1 allows remote attackers to arguments to the RecordClip method, which allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via a \" (double quote) in an argument to the RecordClip method, aka \"parameter injection.\""}, {"lang": "es", "value": "La implementaci\u00f3n del complemento del navegador de RealNetworks RealPlayer v11.0 hasta la v11.1 y RealPlayer SP 1.0 hasta la v1.1 no maneja apropiadamente un caracter sin especificar dentro de los argumentos del m\u00e9todo RecordClip; lo que permite a atacantes remotos descargar programas de su elecci\u00f3n en el ordenador cliente, y ejecutar estos programas, a trav\u00e9s de una llamada a m\u00e9todo modificada. Relacionado con un problema de inyecci\u00f3n de par\u00e1metros."}], "lastModified": "2024-11-21T01:19:30.337", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:realnetworks:realplayer:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8985B3B-BCC9-431D-9788-0C1949DF46E3"}, {"criteria": "cpe:2.3:a:realnetworks:realplayer:11.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C7517C2-71A8-4223-9F9A-2FE5A2153B53"}, {"criteria": "cpe:2.3:a:realnetworks:realplayer:11.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11B7CB5F-ACFA-439B-A9B7-54DA402A6029"}, {"criteria": "cpe:2.3:a:realnetworks:realplayer:11.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2A681B8-62F1-4B23-9E0B-39C61BE72F44"}, {"criteria": "cpe:2.3:a:realnetworks:realplayer:11.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F826B276-91E6-495E-B429-51B1C5ECB146"}, {"criteria": "cpe:2.3:a:realnetworks:realplayer:11.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A732E6C-108F-447F-98B1-EA774A0537EB"}, {"criteria": "cpe:2.3:a:realnetworks:realplayer:11.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D03738C3-D659-488D-B285-64A496C0F1FB"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8BFD9C4F-E93B-4BCE-A5E2-A20945EB8534"}, {"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BBEBAA2-4892-4F9E-8C0E-94CA90DCD28D"}, {"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53D7AE43-A3AC-4B38-B0A3-E6F02834224F"}, {"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59FEDCDF-9FBF-4D08-A50F-FF92763DFC21"}, {"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54A11B3A-547C-4F2F-A58E-DE06DBBE8115"}, {"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7243D80-913D-405C-9988-B8473DB1A5DC"}, {"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4C6D399-FF31-441D-A363-BD53CFE5569A"}, {"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9818A6FB-2CF5-4236-8EFE-95458D603CC1"}, {"criteria": "cpe:2.3:a:realnetworks:realplayer_sp:1.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73CC0582-D889-4907-A32E-218AC2B0591F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}