Vulnerability Details : CVE-2004-0273

Directory traversal vulnerability in RealOne Player, RealOne Player 2.0, and RealOne Enterprise Desktop allows remote attackers to upload arbitrary files via an RMP file that contains .. (dot dot) sequences in a .rjs skin file.

Vulnerability category: Directory traversal

Published 2004-11-23 05:00:00

Updated 2017-10-10 01:30:19

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2004-0273

Probability of exploitation activity in the next 30 days: 0.55%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 75 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2004-0273

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	[email protected]
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2004-0273

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: [email protected] (Primary)

References for CVE-2004-0273

http://www.kb.cert.org/vuls/id/514734

US Government Resource
http://marc.info/?l=bugtraq&m=107642978524321&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/15123
http://service.real.com/help/faq/security/040123_player/EN/

Patch;Vendor Advisory
http://www.securityfocus.com/bid/9580

Patch;Vendor Advisory

Products affected by CVE-2004-0273

Realnetworks » Realone Player » Version: 2.0
cpe:2.3:a:realnetworks:realone_player:2.0:*:*:*:*:*:*:*
Matching versions
Realnetworks » Realone Player » Version: 6.0.11.853
cpe:2.3:a:realnetworks:realone_player:6.0.11.853:*:*:*:*:*:*:*
Matching versions
Realnetworks » Realone Player » Version: 6.0.11.830
cpe:2.3:a:realnetworks:realone_player:6.0.11.830:*:*:*:*:*:*:*
Matching versions
Realnetworks » Realone Player » Version: 6.0.11.841
cpe:2.3:a:realnetworks:realone_player:6.0.11.841:*:*:*:*:*:*:*
Matching versions
Realnetworks » Realone Player » Version: 6.0.11.818
cpe:2.3:a:realnetworks:realone_player:6.0.11.818:*:*:*:*:*:*:*
Matching versions
Realnetworks » Realone Player » Version: 1.0
cpe:2.3:a:realnetworks:realone_player:1.0:*:*:*:*:*:*:*
Matching versions
Realnetworks » Realone Player » Version: 6.0.11.868
cpe:2.3:a:realnetworks:realone_player:6.0.11.868:*:*:*:*:*:*:*
Matching versions
Realnetworks » Realone Player » Version: 2.0 WIN Edition
cpe:2.3:a:realnetworks:realone_player:2.0:*:win:*:*:*:*:*
Matching versions
Realnetworks » Realone Enterprise Desktop » Version: 6.0.11.774
cpe:2.3:a:realnetworks:realone_enterprise_desktop:6.0.11.774:*:*:*:*:*:*:*
Matching versions
Realnetworks » Realone Desktop Manager
cpe:2.3:a:realnetworks:realone_desktop_manager:*:*:*:*:*:*:*:*
Matching versions