RealPlayer haunted by 11 critical vulnerabilities

RealPlayer haunted by 11 critical vulnerabilities

Summary: RealNetworks released an advisory to warn of the vulnerabilities, which could be exploited via rigged image and media files to launch remote code execution attacks.

SHARE:
50

A quick heads-up to any computer users out with RealPlayer installed:  There are at least 11 critical vulnerabilities that expose Windows, Mac and Linux users to malicious hacker attacks.

RealNetworks released an advisory to warn of the vulnerabilities, which could be exploited via rigged image and media files to launch remote code execution attacks.

The vulnerabilities also affect some versions of the Helix Player for Linux.

Here are the details from the RealNetworks alert:

  1. A heap overflow error when processing a malformed ASM Rulebook, which could be exploited to execute arbitrary code.
  2. A heap overflow error when processing a malformed GIF file, which could be exploited to execute arbitrary code.
  3. A buffer overflow error when processing a malformed media file, which could be exploited to execute arbitrary code.
  4. A buffer overflow error when processing a malformed IVR file, which could be exploited to execute arbitrary code.
  5. A heap overflow error when processing a malformed IVR file, which could be exploited to execute arbitrary code.
  6. A heap overflow error related to the SIPR Codec, which could be exploited to execute arbitrary code.
  7. A heap overflow error when processing a malformed compressed GIF, which could be exploited to execute arbitrary code.
  8. A heap overflow error when parsing a malformed SMIL file, which could be exploited to execute arbitrary code.
  9. A heap overflow error when parsing a malformed Skin, which could be exploited to execute arbitrary code.
  10. An array overflow error when parsing a malformed ASM RuleBook, which could be exploited to execute arbitrary code.
  11. A buffer overflow error related to rtsp "set_parameter" method, which could be exploited to execute arbitrary code.

RealPlayer is a favorite target for malware writers and fraudware purveyors who rig exploits into Web pages to launch drive-by download attacks.  This should be treated as a critical update for all RealPlayer users. If you don't use the software, you are best advised to uninstall it immediately.

GALLERY:

Topics: Hardware, Mobility, Security

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

50 comments
Log in or register to join the discussion
  • Does anyone use RealPlayer any more?

    I haven't used it in years. Nor do I know anyone that does use it.
    Letophoro
    • Nope

      What's Real? Lol.
      The one and only, Cylon Centurion
      • It's like FORTRAN.

        Minus the novelty and nostalgia.
        AzuMao
        • I'd rather use FORTRAN.

          And certainly COBOL.
          dgurney
      • backflash

        Lets not play stupid, we all downloaded and were
        quite amazed by the first real player versions.
        Well maybe some of you born too late got skipped
        of the fun. Lets not forget how we jammed to real
        player back in old school.to Real networks, get
        you act together, forget real player and start
        from scratch, make something you can be proud of
        :)
        sywarp
    • Willing to bet someone in Google China may

      If so many still use IE6 then it's fair to say some still use RP. Doh!
      TxM2xTx
      • Ya just like those peeps in Symantec and the other 31 companies that

        got hacked because of IE's insecurities.
        AzuMao
    • The government..

      ...at least the FCC. All those Broadband forums and panels they've been having, the videos they post have to be viewed with RealPlayer.
      jayja1
    • I thought RP went away with Myspace

      I wonder what else is still out there LOL
      fraaaank
    • Is Real Player Still Around?

      I was thinking the same thing, "who still uses Real Player?"
      DarienHawk67
  • FUD!

    [i]There are at least 11 critical vulnerabilities that expose Windows, Mac and Linux users to malicious hacker attacks.[/i]
    I'll bet my one month paycheck that Linux users are safe despite Real.
    The malware is just for windoze.
    Linux Geek
    • Oh you mean.....

      XP, I would bet my month paycheck that Vista and 7 would be safe. XP has flaws, I advise everyone to move off of it now. I know you will keep comparing Linux to XP until the end of time. Thats usually how it works. Oh and wasn't at all worried about the China hacks, we were safe here because we keep up with the times unlike Google and such.
      OhTheHumanity
      • They aren't.

        Nothing was changed in them that would affect this.

        The vulnerability is in RealPlayer, and has nothing to do with what version of Windows you run. It doesn't involve the Windows API.
        AzuMao
        • UAC would stop most of these things

          As would DEP.
          Lerianis10
          • UAC has no effect on these; you do not need admin rights to exploit any of

            them. And DEP hasn't changed any from Windows XP
            to Windows Vista or Windows 7.

            I doubt RealPlayer even supports it anyways.
            AzuMao
          • Ways to propagate

            Yep, writing to other songs or skins or videos does not reqiure admin rights. Seems like the perfect way for malicious code to propagate itself to other systems via media file sharing.

            Once distributed, the code can find an user running as admin in XP or a system with an unpatched local privilege escalation vulnerability.

            Oops, it's time for a <a href="http://secunia.com/advisories/search/?adv_search=1&s=1&search=linux+kernel&vuln_title=1&vuln_software_os=1&vuln_bodytext=1&vuln_cve=1&critical%5B%5D=1&critical%5B%5D=2&critical%5B%5D=3&critical%5B%5D=4&impact%5B%5D=3&where%5B%5D=3&sort_by=date">patch</a> or <a href="http://secunia.com/advisories/search/?adv_search=1&s=1&search=vista&vuln_title=1&vuln_software_os=1&vuln_bodytext=1&vuln_cve=1&critical%5B%5D=1&critical%5B%5D=2&critical%5B%5D=3&critical%5B%5D=4&impact%5B%5D=3&where%5B%5D=3&sort_by=date">two</a>.

            Or may be <a href="http://secunia.com/advisories/search/?adv_search=1&s=1&search=Mac+OS+X&vuln_software_os=1&critical%5B%5D=1&critical%5B%5D=2&critical%5B%5D=3&critical%5B%5D=4&impact%5B%5D=3&where%5B%5D=2&where%5B%5D=1&where%5B%5D=3&sort_by=date">three</a>. I particularly like #22 from the <a href="http://secunia.com/advisories/37313/">recent update</a> because of <a href="http://blogs.zdnet.com/security/?p=3851">this</a>.
            Earthling2
          • Don't most people use their own keyboards?

            The ones that come bundled are always shit,
            whoever you buy the computer from (Apple, Dell,
            HP, etc).
            AzuMao
      • No, he means......

        Yes, your smugness. Good thing you didn't post where you were at-you wouldn't be safe with a challenge like that.
        DirtyDingus
        • "Where you were at"?

          What's the "at" doing at the end of that sentence?
          dgurney
    • given that your one month paycheck is FOSS

      you wouldn't be betting on much.
      SystemVoid