Quantum Secular Labs / Blog / Advisories
CVE-2003-1509: Realnetworks Realone Enterprise Desktop: Remote code execution
CVE-2003-1509 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Realnetworks Realone Enterprise Desktop. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.
Vulnerability description
Real Networks RealOne Enterprise Desktop 6.0.11.774, RealOne Player 2.0, and RealOne Player 6.0.11.818 through RealOne Player 6.0.11.853 allows remote attackers to execute arbitrary script in the local security zone by embedding script in a temp file before the temp file is executed by the default web browser.
Severity breakdown
CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C
- Access vector: Network. Exploitable remotely over the network.
- Access complexity: Low. No special conditions are required.
- Authentication: None. No authentication is needed.
- Confidentiality impact: Complete. Total information disclosure.
- Integrity impact: Complete. Total loss of integrity.
- Availability impact: Complete. Total shutdown of the component.
Affected products
- Realnetworks Realone Enterprise Desktop: 6.0.11.774
- Realnetworks Realone Player: 2.0; 6.0.11.818; 6.0.11.830; 6.0.11.841; 6.0.11.853