'High Risk' RealPlayer Flaws Patched
Del.icio.us
Digg
Google
Spurl
Blink
Furl
Y! MyWeb
Share:
Sponsors:
By Ryan Naraine
Digital media delivery firm RealNetworks Inc. late Thursday shipped a major security update for its RealPlayer software to patch a pair of remote code execution vulnerabilities.
The security holes, which were reported to RealNetworks more than four months ago, could be exploited by malicious hackers to take complete control over a vulnerable machine.
According to eEye Digital Security, the company that discovered the bugs, the most serious flaw exists in the first data packet contained in a Real Media file. By specially crafting a malformed ".rm" movie file, a direct stack overwrite is triggered, and reliable code execution is possible.
Affected software include RealPlayer 8, RealPlayer 10, RealOne Player v1, RealOne Player v2, RealPlayer Enterprise (Windows): RealPlayer 10 (Mac); RealPlayer 10 and Helix Player (Linux).
A second flaw, confirmed as "high risk" by RealNetworks, can allow a RealPlayer skin file (.rjs extension) to be downloaded and applied automatically through a Web browser without the user's permission.
A skin file is a bundle of graphics and a .ini file, stored together in ZIP format. DUNZIP32.DLL, which is included with RealPlayer, is used to extract the contents of the skin file.
When RealPlayer processes a zip file, it will allocate the field of the file, but when it is copied it will rely on real unzip content to copy, eEye explained in an advisory.
RealNetworks recommends that users apply the appropriate RealPlayer patches urgently. HERE YOU CAN
The patch is available via the "Check for Update" menu item under Tools on the RealPlayer menu bar.
Article submitted by: Webshark
Last Update: 11-14-2005
Category: Off Topic Info
Digital media delivery firm RealNetworks Inc. late Thursday shipped a major security update for its RealPlayer software to patch a pair of remote code execution vulnerabilities.
The security holes, which were reported to RealNetworks more than four months ago, could be exploited by malicious hackers to take complete control over a vulnerable machine.
According to eEye Digital Security, the company that discovered the bugs, the most serious flaw exists in the first data packet contained in a Real Media file. By specially crafting a malformed ".rm" movie file, a direct stack overwrite is triggered, and reliable code execution is possible.
Affected software include RealPlayer 8, RealPlayer 10, RealOne Player v1, RealOne Player v2, RealPlayer Enterprise (Windows): RealPlayer 10 (Mac); RealPlayer 10 and Helix Player (Linux).
A second flaw, confirmed as "high risk" by RealNetworks, can allow a RealPlayer skin file (.rjs extension) to be downloaded and applied automatically through a Web browser without the user's permission.
A skin file is a bundle of graphics and a .ini file, stored together in ZIP format. DUNZIP32.DLL, which is included with RealPlayer, is used to extract the contents of the skin file.
When RealPlayer processes a zip file, it will allocate the field of the file, but when it is copied it will rely on real unzip content to copy, eEye explained in an advisory.
RealNetworks recommends that users apply the appropriate RealPlayer patches urgently. HERE YOU CAN
The patch is available via the "Check for Update" menu item under Tools on the RealPlayer menu bar.
Article submitted by: Webshark
Last Update: 11-14-2005
Category: Off Topic Info
Current rating: 5.71 by 42 users
| Would you recommend this article to a friend? |
| Not a Chance | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | Absolutely |
Related News Stories
(14,956 reads) 03-29-2007
· Adobe Photoshop CS3 published(12,900 reads) 08-03-2006
· FBI calls for hacker help.(14,763 reads) 07-20-2006
· Become a Friend of Firefox.(12,550 reads) 07-15-2006
· Recently unearthed e-mail reveals what life was like in 1995(14,351 reads) 02-23-2006
· Inside Windows Vista ( Build 5308) + slide show(13,063 reads) 02-21-2006
· do-you-have-a.COM ? thinking-to-buy-a.COM ?(13,230 reads) 01-17-2006
· Websites judged in milliseconds(13,828 reads) 01-17-2006
· Stolen Corvette found after 37 years (Reuters)(13,448 reads) 01-17-2006
· Two patients in surgical slip-up (Reuters)(12,833 reads) 01-17-2006
· Goose Poop a Problem for Oakland Parkgoers (AP)
Please register or sign-in to post comments.