RealNetworks Realplayer QCP Parsing Heap Overflow

This module exploits a heap overflow in Realplayer when handling a .QCP file. The specific flaw exists within qcpfformat.dll. A static 256 byte buffer is allocated on the heap and user-supplied data from the file is copied within a memory copy loop. This allows a remote attacker to execute arbitrary code running in the context of the web browser via a .QCP file with a specially crafted "fmt" chunk. At this moment this module exploits the flaw on Windows XP IE6, IE7.

Search Other Modules

Exploit Rank

• Average

Exploit Authors

• Sean de Regge < >
• juan vazquez < >

Vulnerability References

• CVE-2011-2950
• OSVDB-74549
• BID-49172
• http://www.zerodayinitiative.com/advisories/ZDI-11-265/
• http://service.real.com/realplayer/security/08162011_player/en/
• http://lists.helixcommunity.org/pipermail/datatype-cvs/2011-April/015469.html

Exploit Targets

• 0 - Automatic (default)
• 1 - Internet Explorer 6 on XP SP3
• 2 - Internet Explorer 7 on XP SP3

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/windows/browser/adobe_cooltype_sing
• exploit/windows/browser/adobe_flash_mp4_cprt
• exploit/windows/browser/adobe_flash_sps
• exploit/windows/browser/adobe_flashplayer_avm
• exploit/windows/browser/adobe_flashplayer_flash10o
• exploit/windows/browser/adobe_flashplayer_newfunction
• exploit/windows/browser/adobe_flatedecode_predictor02
• exploit/windows/browser/adobe_geticon
• exploit/windows/browser/adobe_jbig2decode
• exploit/windows/browser/adobe_media_newplayer

Exploit Usage Information

Exploit Module Options