High-severity flaw plagues RealOne Player, RealPlayer

Article

High-severity flaw plagues RealOne Player, RealPlayer

Shawna McAlearney, News Writer

To correct a high-severity flaw that impacts millions of users, RealNetworks Inc. recommends upgrading numerous versions of its RealOne Player and RealPlayer to correct security vulnerabilities that could allow an attacker to run arbitrary code on a user's machine.

According to one of the flaw's discoverers, U.K.-based NGSSoftware's John Heasman, RealOne and RealPlayer are the most widely used products for Internet media delivery and are used by more than 200 million users worldwide. The specific number of users affected by the flaw was not released.

"This vulnerability is of high severity given the size of RealNetwork's user base, and given that an attacker could potentially execute code," said Heasman, a security analyst. "Furthermore, the bug is in a core component of RealPlayer, thus it affects the all current versions, from the free player that a home user might download, to the Enterprise edition that an organisation might deploy company-wide."

Affected versions include: RealOne Player (English), RealOne Player version 2 (all languages), RealPlayer 8 (all languages), RealPlayer 10 (English, German and Japanese), RealPlayer Enterprise (all versions, standalone and as configured by the RealPlayer Enterprise Manager).

Heasman said that by crafting a malformed .RA, .RM, .RV or .RMJ file, and forcing a browser or enticing a user to a Web site containing such a file, it's possible to cause heap corruption that can lead to execution of arbitrary attacker-supplied

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

code on the target machine. This code will run in the security context of the logged on user. E-mail attachments are another vector for this type of attack.

"Due to the ease of exploitation these vulnerabilities should be considered high risk," said the NGSSoftware advisory.

Users of RealOne Player, RealOne Player version 2 (all languages) and RealPlayer 10 (English, German and Japanese only) should read the RealOne advisory for the steps involved to update their systems. There is no update available for RealPlayer 8; RealNetworks recommended upgrading to RealPlayer 10. For information on patching the RealPlayer Enterprise Manager, contact your technical account manager or RealNetworks customer support.