The RealNetworks RealArcade platform includes an ActiveX control (InstallerDlg.dll, version 2.6.0.445) that exposes a method named Exec via the StubbyUtil.ProcessMgr COM object. This method allows remote attackers to execute arbitrary commands on a victim’s Windows machine without proper validation or restrictions. The platform has since consolidated with RealNetworks’ GameHouse.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2011-10028 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious web page that invokes the vulnerable ActiveX control. When a user visits the page, the control can execute arbitrary commands on the user’s system, leading to potential system compromise.
Affected Products
- RealArcade: A gaming platform that allows users to download and play games, which is affected by the vulnerable ActiveX control.
- GameHouse: The consolidated platform that includes RealArcade games and is also impacted by this vulnerability.
Mitigation
To mitigate this vulnerability, users should disable the ActiveX control in their web browsers or uninstall the RealArcade platform. Additionally, keeping software up to date and applying security patches can help protect against exploitation.