RealPlayer users urged to patch

Bill Brenner

RealNetworks Inc. has urged users of its popular multimedia players to install patches that fix two security holes attackers could exploit to cause a buffer overflow and launch malicious code.

"RealNetworks Inc. has addressed recently discovered security vulnerabilities that offered the potential for an attacker to run arbitrary or malicious code on a customer's machine," the Seattle-based vendor said in an

    Requires Free Membership to View

advisory. "RealNetworks has received no reports of machines compromised as a result of the now-remedied vulnerabilities."

Danish security firm Secunia called the vulnerabilities "highly critical" in its advisory.

The first problem, reported by Mark Litchfield of British security firm NGS Software, is a boundary error within the processing of .wav [wave] files. An attacker could exploit the flaw

More on RealPlayer

'Highly critical' flaws fixed in RealPlayer

Multiple vulnerabilities leave millions of RealPlayer users open to attacks

to cause a buffer overflow using a specially crafted .wav file.

A wave file is an audio file format created by Microsoft that has become a standard PC format for everything from system and game sounds to CD-quality audio. Wave files are identified by a file extension of .wav. Used primarily in PCs, the format has been accepted as a viable interchange medium for other computer platforms, such as Macintosh. This allows content developers to freely move audio files between platforms for processing, for example.

The second problem, reported by Reston, Va.-based security firm iDefense, is a stack-based buffer overflow vulnerability in the Synchronized Multimedia Integration Language (SMIL) file format parser within various versions of RealPlayer. An attacker could exploit the flaw -- caused by an unbounded string copying operation -- to launch malicious code.

SMIL is a language that allows Web site creators to be able to easily define and synchronize multimedia elements (video, sound, still images) for Web presentation and interaction.

The vulnerabilities affect:

  • Helix Player 1.0
  • RealOne Player version 1
  • RealOne Player version 2
  • RealPlayer 10
  • RealPlayer 8
  • RealPlayer Enterprise 1.0

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: