CVE-2002-1015

RealJukebox 2 1.0.2.340 and 1.0.2.379, and RealOne Player Gold 6.0.10.505, allows remote attackers to execute arbitrary script in the Local computer zone by inserting the script into the skin.ini file of an RJS archive, then referencing skin.ini from a web page after it has been extracted, which is parsed as HTML by Internet Explorer or other Microsoft-based web readers.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2002-07/0130.html
http://service.real.com/help/faq/security/bufferoverrun07092002.html
http://www.iss.net/security_center/static/9539.php	Patch Vendor Advisory
http://www.kb.cert.org/vuls/id/888547	US Government Resource
http://www.securityfocus.com/bid/5210	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:realnetworks:realjukebox_2:1.0.2.340:::::::*
	cpe:2.3:a:realnetworks:realjukebox_2:1.0.2.379:::::::*
	cpe:2.3:a:realnetworks:realjukebox_2_plus:1.0.2.340:::::::*
	cpe:2.3:a:realnetworks:realjukebox_2_plus:1.0.2.379:::::::*
	cpe:2.3:a:realnetworks:realone_player:6.0.10.505:gold::::::

History

No history.

Information

Published : 2002-10-04 04:00

Updated : 2008-09-05 20:29

NVD link : CVE-2002-1015

Mitre link : CVE-2002-1015

CVE.ORG link : CVE-2002-1015

JSON object : View

Products Affected

realnetworks

realone_player
realjukebox_2
realjukebox_2_plus

CWE

NVD-CWE-Other

{"id": "CVE-2002-1015", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2002-10-04T04:00:00.000", "references": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2002-07/0130.html", "source": "cve@mitre.org"}, {"url": "http://service.real.com/help/faq/security/bufferoverrun07092002.html", "source": "cve@mitre.org"}, {"url": "http://www.iss.net/security_center/static/9539.php", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/888547", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/5210", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "RealJukebox 2 1.0.2.340 and 1.0.2.379, and RealOne Player Gold 6.0.10.505, allows remote attackers to execute arbitrary script in the Local computer zone by inserting the script into the skin.ini file of an RJS archive, then referencing skin.ini from a web page after it has been extracted, which is parsed as HTML by Internet Explorer or other Microsoft-based web readers."}], "lastModified": "2008-09-05T20:29:33.080", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:realnetworks:realjukebox_2:1.0.2.340:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B8A693D-A504-4949-9947-0D7CFC8849C5"}, {"criteria": "cpe:2.3:a:realnetworks:realjukebox_2:1.0.2.379:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3887C616-8817-414A-9FD9-B5B365420A83"}, {"criteria": "cpe:2.3:a:realnetworks:realjukebox_2_plus:1.0.2.340:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "869156EC-1587-4CAB-836F-BF6A7D556F3B"}, {"criteria": "cpe:2.3:a:realnetworks:realjukebox_2_plus:1.0.2.379:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "911D7615-7AEC-4F17-AC04-E5AF35B549DA"}, {"criteria": "cpe:2.3:a:realnetworks:realone_player:6.0.10.505:gold:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BBC41FB-B9F5-47EB-97D8-3ACFC5182AAE"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}