'High Risk' RealPlayer Flaws Patched
Del.icio.us
Digg
Google
Spurl
Blink
Furl
Y! MyWeb
Share:
Sponsors:
By Ryan Naraine
Digital media delivery firm RealNetworks Inc. late Thursday shipped a major security update for its RealPlayer software to patch a pair of remote code execution vulnerabilities.
The security holes, which were reported to RealNetworks more than four months ago, could be exploited by malicious hackers to take complete control over a vulnerable machine.
According to eEye Digital Security, the company that discovered the bugs, the most serious flaw exists in the first data packet contained in a Real Media file. By specially crafting a malformed ".rm" movie file, a direct stack overwrite is triggered, and reliable code execution is possible.
Affected software include RealPlayer 8, RealPlayer 10, RealOne Player v1, RealOne Player v2, RealPlayer Enterprise (Windows): RealPlayer 10 (Mac); RealPlayer 10 and Helix Player (Linux).
A second flaw, confirmed as "high risk" by RealNetworks, can allow a RealPlayer skin file (.rjs extension) to be downloaded and applied automatically through a Web browser without the user's permission.
A skin file is a bundle of graphics and a .ini file, stored together in ZIP format. DUNZIP32.DLL, which is included with RealPlayer, is used to extract the contents of the skin file.
When RealPlayer processes a zip file, it will allocate the field of the file, but when it is copied it will rely on real unzip content to copy, eEye explained in an advisory.
RealNetworks recommends that users apply the appropriate RealPlayer patches urgently. HERE YOU CAN
The patch is available via the "Check for Update" menu item under Tools on the RealPlayer menu bar.
Article submitted by: Webshark
Last Update: 11-14-2005
Category: Off Topic Info
Digital media delivery firm RealNetworks Inc. late Thursday shipped a major security update for its RealPlayer software to patch a pair of remote code execution vulnerabilities.
The security holes, which were reported to RealNetworks more than four months ago, could be exploited by malicious hackers to take complete control over a vulnerable machine.
According to eEye Digital Security, the company that discovered the bugs, the most serious flaw exists in the first data packet contained in a Real Media file. By specially crafting a malformed ".rm" movie file, a direct stack overwrite is triggered, and reliable code execution is possible.
Affected software include RealPlayer 8, RealPlayer 10, RealOne Player v1, RealOne Player v2, RealPlayer Enterprise (Windows): RealPlayer 10 (Mac); RealPlayer 10 and Helix Player (Linux).
A second flaw, confirmed as "high risk" by RealNetworks, can allow a RealPlayer skin file (.rjs extension) to be downloaded and applied automatically through a Web browser without the user's permission.
A skin file is a bundle of graphics and a .ini file, stored together in ZIP format. DUNZIP32.DLL, which is included with RealPlayer, is used to extract the contents of the skin file.
When RealPlayer processes a zip file, it will allocate the field of the file, but when it is copied it will rely on real unzip content to copy, eEye explained in an advisory.
RealNetworks recommends that users apply the appropriate RealPlayer patches urgently. HERE YOU CAN
The patch is available via the "Check for Update" menu item under Tools on the RealPlayer menu bar.
Article submitted by: Webshark
Last Update: 11-14-2005
Category: Off Topic Info
Current rating: 5.71 by 42 users
| Would you recommend this article to a friend? |
| Not a Chance | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | Absolutely |
Related News Stories
(15,156 reads) 03-29-2007
· Adobe Photoshop CS3 published(13,144 reads) 08-03-2006
· FBI calls for hacker help.(14,975 reads) 07-20-2006
· Become a Friend of Firefox.(12,734 reads) 07-15-2006
· Recently unearthed e-mail reveals what life was like in 1995(14,565 reads) 02-23-2006
· Inside Windows Vista ( Build 5308) + slide show(13,265 reads) 02-21-2006
· do-you-have-a.COM ? thinking-to-buy-a.COM ?(13,440 reads) 01-17-2006
· Websites judged in milliseconds(14,030 reads) 01-17-2006
· Stolen Corvette found after 37 years (Reuters)(13,642 reads) 01-17-2006
· Two patients in surgical slip-up (Reuters)(13,027 reads) 01-17-2006
· Goose Poop a Problem for Oakland Parkgoers (AP)
Please register or sign-in to post comments.