RealPlayer users urged to patch

New patches fix two security holes in widely used RealPlayer. An attacker who exploits them could launch malicious code.

RealNetworks Inc. has urged users of its popular multimedia players to install patches that fix two security holes attackers could exploit to cause a buffer overflow and launch malicious code.

"RealNetworks Inc. has addressed recently discovered security vulnerabilities that offered the potential for an attacker to run arbitrary or malicious code on a customer's machine," the Seattle-based vendor said in an advisory. "RealNetworks has received no reports of machines compromised as a result of the now-remedied vulnerabilities."

Danish security firm Secunia called the vulnerabilities "highly critical" in its advisory.

The first problem, reported by Mark Litchfield of British security firm NGS Software, is a boundary error within the processing of .wav [wave] files. An attacker could exploit the flaw

More on RealPlayer

'Highly critical' flaws fixed in RealPlayer

Multiple vulnerabilities leave millions of RealPlayer users open to attacks

to cause a buffer overflow using a specially crafted .wav file.

A wave file is an audio file format created by Microsoft that has become a standard PC format for everything from system and game sounds to CD-quality audio. Wave files are identified by a file extension of .wav. Used primarily in PCs, the format has been accepted as a viable interchange medium for other computer platforms, such as Macintosh. This allows content developers to freely move audio files between platforms for processing, for example.

The second problem, reported by Reston, Va.-based security firm iDefense, is a stack-based buffer overflow vulnerability in the Synchronized Multimedia Integration Language (SMIL) file format parser within various versions of RealPlayer. An attacker could exploit the flaw -- caused by an unbounded string copying operation -- to launch malicious code.

SMIL is a language that allows Web site creators to be able to easily define and synchronize multimedia elements (video, sound, still images) for Web presentation and interaction.

The vulnerabilities affect:

  • Helix Player 1.0
  • RealOne Player version 1
  • RealOne Player version 2
  • RealPlayer 10
  • RealPlayer 8
  • RealPlayer Enterprise 1.0

Dig deeper on Securing Productivity Applications

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close