Multiple vulnerabilities leave millions of RealPlayer users open to attacks

Article

Multiple vulnerabilities leave millions of RealPlayer users open to attacks

Edmund X. DeJesus, Staff Writer

Popular Internet media players from RealNetworks must be upgraded to fix multiple vulnerabilities. Errors in handling music and video files can lead to remote code execution or system compromise.

More than 350 million registered users employ Internet media players like RealOne and RealPlayer, including enterprise employees. Jouko Pynnonen and other security researchers at NGSSoftware have

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

.discovered that these players have heap and buffer overflows when parsing media files, including RAM (RealAudio), RP (RealPix ), RPM (RealAudio Plugin), RT (RealText) and SMIL (synchronized multimedia integration language) formats

Malicious attackers can create media files that will cause overflows and possibly execute arbitrary code on the user's machine. The RPM file vulnerability may also allow the download and execution of arbitrary code on a user's system. The altered media files can reside passively on a remote Web site until a user clicks on them or could be in an e-mail attachment.

The vulnerability affects RealOne Player version 1 and 2, RealPlayer 8 and 10, and RealOne Enterprise Desktop. RealPlayer suffered similar problems in April 2003 with PNG (Portable Network Graphics) format files. RealNetworks has supplied upgrades.