Sploitus

CVE-2008-1309

6 known exploits for CVE-2008-1309

The RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll in RealNetworks RealPlayer Enterprise, RealPlayer 10, RealPlayer 10.5 before build 6.0.12.1675, and RealPlayer 11 before 11.0.3 build 6.0.14.806 does not properly manage memory for the (1) Console or (2) Controls property, which allows remote attackers to execute arbitrary code or cause a denial of service (browser crash) via a series of assignments of long string values, which triggers an overwrite of freed heap memory.

Affected products
Realplayer, Realplayer Enterprise
Realnetworks Realplayer
All versions
CVSS 2.0
9.3 HIGH
EPSS
46.0% (99th percentile)
Weakness
CWE-399
NVD status
Modified
Published
2008-03-12
CVE-2008-1309 at NVD
Authoritative description, scoring and affected products

6 known exploits for CVE-2008-1309

Proof-of-concept code and exploit modules indexed by Sploitus

RealPlayer - 'rmoc3260.dll' ActiveX Control Heap Corruption (Metasploit)
2010-06-15 MetasploitEXPLOITDBRuby
realplayer-activexexec.txt
2008-04-02 Elazar BroadPACKETSTORM
realplayer_console.rb.txt
2008-04-02 Elazar BroadPACKETSTORMRuby
RealPlayer rmoc3260.dll ActiveX Control Heap Corruption
2008-04-01 Elazar Broad <elazarb@earthlink.net>METASPLOITRuby
Real Player - 'rmoc3260.dll' ActiveX Control Remote Code Execution
2008-04-01 ElazarEXPLOITDB
DSquare Exploit Pack: D2SEC_REALCONSOLE
2008-03-12 DSquareD2