RealPlayer Users urged to Patch Security Hole

[Astrocloud]

http://www.theregister.co.uk/content/55/35390.html

Unholy trio of RealOne Player holes unearthed
By John Leyden
Posted: 06/02/2004 at 11:59 GMT

RealOne Player users tricked into running maliciously constructed media files could surrender control of their machine to crackers because of three security vulnerabilities revealed this week.

Real Networks has acknowledged the problems and issued fixes - which users strongly urged to apply.

The first exploit involves a JavaScript vulnerability affecting RealOne Player, RealOne Player 2 for Windows only (all languages), RealPlayer 10 Beta (English only) and RealOne Enterprise Desktop or RealPlayer Enterprise.

A flaw that might allow a cracker to execute arbitrary code on a target PC if he was able to trick them into downloading and executing a maliciously constructed .RMP file affects a slightly broadened range of software. This one blights RealOne Player, RealOne Player 2 (all language versions, all platforms), and RealOne Enterprise Desktop or RealPlayer Enterprise (all versions).

Lastly, we have a vulnerability which would allow crackers to construct media files fashioned to create buffer overrun errors in RealOne Player and RealPlayer 8 (all language versions).

This flaw, like the second, opens the way for attackers to run arbitrary code on target machine. From that point on it's game over in security terms and your PC is as good as 0wn3d.

In an advisory, Real Networks said it had not received any reports of anyone actually being attacked with this exploit but that nonetheless it was treating the issue seriously - as should Real Player users.

The advisory gives instructions on how to apply the patch Real Networks has issued.

Credit for discovering the vulnerabilities goes to Jouko Pynnonen and Mark Litchfield of Next-Generation Security Software. ®

[Destrox]

Damn, i was hoping the "Patch" was Uninstall it and install "Real Alternative"

Someday...

Good info on a serious note.

[nanofever]

Originally posted by Destrox
Damn, i was hoping the "Patch" was Uninstall it and install "Real Alternative"

Someday...

Good info on a serious note.

My sentiments exactly, Realplayer has significantly bigger problems than a few security holes. The large sucking hole that comprises Realplayer for one...

[ToolBag]

Go Real Alternative, I dont understand why so many sites use such a media player for their stuff. HORSE SHIT I TELL YOU!!!

[Latch]

[ToolBag]

That is a gay ol time of a picture! hehehe!

[bltzkriegmcanon]

lolz