module
RealNetworks Realplayer QCP Parsing Heap Overflow
Disclosed | Created |
---|---|
2011-08-16 | 2018-05-30 |
Disclosed
2011-08-16
Created
2018-05-30
Description
This module exploits a heap overflow in Realplayer when handling a .QCP file.
The specific flaw exists within qcpfformat.dll. A static 256 byte buffer is
allocated on the heap and user-supplied data from the file is copied within a
memory copy loop.
This allows a remote attacker to execute arbitrary code running in the context
of the web browser via a .QCP file with a specially crafted "fmt" chunk.
At this moment this module exploits the flaw on Windows XP IE6, IE7.
The specific flaw exists within qcpfformat.dll. A static 256 byte buffer is
allocated on the heap and user-supplied data from the file is copied within a
memory copy loop.
This allows a remote attacker to execute arbitrary code running in the context
of the web browser via a .QCP file with a specially crafted "fmt" chunk.
At this moment this module exploits the flaw on Windows XP IE6, IE7.
Authors
Sean de Regge
juan vazquez juan.vazquez@metasploit.com
juan vazquez juan.vazquez@metasploit.com
Platform
Windows
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:

NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.