Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

RealPlayer haunted by 'critical' security holes

By Ryan Naraine | September 1, 2010, 11:47am PDT

Summary: RealNetworks has shipped a critical update to address multiple vulnerabilities, some serious enough to allow a remote, unauthenticated attacker to execute arbitrary code or obtain sensitive information.

If you still have the RealPlayer software on your machine, now might be a good time to uninstall it. If you really need to keep it (why?), it’s definitely time to apply the latest update to avoid malicious hacker attacks.

RealNetworks has shipped a critical update to address multiple vulnerabilities, some serious enough to allow a remote, unauthenticated attacker to execute arbitrary code or obtain sensitive information.

Some raw details:

CVE-2010-2996: RealPlayer malformed IVR pointer index code execution vulnerability. Affected software: Windows RealPlayer 11.1 and prior.
CVE-2010-3002: RealPlayerActiveX unauthorized file access vulnerability. Affected software: Windows RealPlayer 11.1 and prior.
CVE-2010-0116: RealPlayer QCP files parsing integer overflow vulnerability. Affected software: Windows RealPlayer SP 1.1.4 and prior.
CVE-2010-0117: RealPlayer processing of dimensions in the YUV420 transformation of MP4 content vulnerability. Affected software: Windows RealPlayer SP 1.1.4 and prior.
CVE-2010-0120: RealPlayer QCP parsing heap-based buffer overflow vulnerability.
Affected software: Windows RealPlayer SP 1.1.4 and prior.
CVE-2010-3001: RealPlayer ActiveX IE Plugin vulnerability opening multiple browser windows.
Affected software: Windows RealPlayer SP 1.1.4 and prior.
CVE-2010-3000: RealPlayer FLV parsing multiple integer overflow vulnerability. Affected software: Windows RealPlayer SP 1.1.4 and prior.

Details on affected RealPlayer versions are available in this RealNetworks advisory.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Zero Day”

Verizon DBIR challenge clue #4

Microsoft ships 'Fix-It' for DLL load hijacking attack vector

Topics

Vulnerability, Patch Management, RealNetworks RealPlayer, Digital Music, Microsoft Windows, Digital Media, Security, Personal Technology, Operating Systems, Software, Consumer Electronics, Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Full Bio
Disclosure
Contact

Vendor HotSpot

The 360° Conversation around Cloud Computing

TECH VISUALIZER brings the social conversation to life... powered by Brocade

Learn More »

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?

Ask a Question Start a Discussion

Comments

Add Your Opinion

Join the conversation!

Follow via:: RSS; Email Alert

Just In

RE: RealPlayer haunted by 'critical' security holes

ssole 1st Nov

Lo mejor de esto son los puzzles personalizados con fotos

View in thread

Please Select
Please Select

0 Votes

+ -

Thanks for posting

Lacy Kemp 1st Sep 2010

Hi Ryan,
Thanks for posting about these security issues. We're trying to get the word out, too. One thing I just want to flag is that none of the current versions of RealPlayer are affected by any of these bugs. Regardless, it's always best to run the latest version.

Thanks,
Lacy Kemp @ RealNetworks

Reply
Flag

0 Votes

+ -

RE: RealPlayer haunted by 'critical' security holes

lovedong 13th Sep

I LOVE THIS POST replica watches

Reply
Flag

0 Votes

+ -

RE: RealPlayer haunted by 'critical' security holes

casper01 19th Sep

@Lacy Kemp They should have fixed this a long time ago Tasmania Hospitality

Reply
Flag

0 Votes

+ -

RE: RealPlayer haunted by 'critical' security holes

casper01 20th Sep

@Lacy Kemp Yes thank you very much Buy Twitter Followers

Reply
Flag

0 Votes

+ -

RE: RealPlayer haunted by 'critical' security holes

lkjlkjadf 1st Sep 2010

Lacy, I think you may be one of the few still using it.

With Facebook and others trampling on privacy now, it's nice to recall a time when a company's overreaching could effectively kill it.

Reply
Flag

0 Votes

+ -

RE: RealPlayer haunted by 'critical' security holes

marlin_s 2nd Sep 2010

People still use RealPlayer??!?

Reply
Flag

0 Votes

+ -

RE: RealPlayer haunted by 'critical' security holes

uniqueaijaz 28th Aug

RealPlayer the best media player ever!!

Reply
Flag

0 Votes

+ -

RE: RealPlayer haunted by 'critical' security holes

MACKENZI 10th Sep

I also desire to signal in your RSS feeds. Thank you as soon as once again and maintain up the great operate! nccma cooler

Reply
Flag

0 Votes

+ -

RE: RealPlayer haunted by 'critical' security holes

MARAGARET 11th Sep

I used to be more than happy to seek out this internet-site.I wanted to thanks in your time for this glorious read!! I positively enjoying each little bit of it and I have you bookmarked to check out new stuff you weblog post. this thread is amazing i like your work and i appreciate you that you have share a useful stuff thanks for sharing the i shop abatwa

Reply
Flag

0 Votes

+ -

RE: RealPlayer haunted by 'critical' security holes

RHIANNONA 13th Sep

I used to be more than happy to seek out this internet-site.I wanted to thanks in your time for this glorious read!! I positively enjoying each little bit of it and I have you bookmarked to check out new stuff you weblog post.Bookmarking now thanks please consider a follow up post. power sa shop

Reply
Flag

0 Votes

+ -

RE: RealPlayer haunted by 'critical' security holes

SATURNINA 13th Sep

I think the representation of this article is actually superb one. This is my first visit to your site. Thanks a lot and keep sharing the information. Keep updating the information for all of us. Thanks ZDNet Government was launched as the brand's first industry vertical, with a mission to cater to IT professionals in the public secto I agree with your post. However, do you have any sources I can cite for my paper wheel car com bury

Reply
Flag

0 Votes

+ -

RE: RealPlayer haunted by 'critical' security holes

TOCCAR 25th Sep

Well welcome, hopefully you can become a vital member of the community and really help to push far ahead of google. Which Im sure the development team would love. This will of course earn you alot points too and get you on the leaders board. z d n e t t h a n k Im not sure i come to an agreement with you on every level, howevor it absolutely was a good posting, many thanks for taking the time to put up your ideas.

Reply
Flag

0 Votes

+ -

RE: RealPlayer haunted by 'critical' security holes

CLAUDET 26th Sep

This is my first visit to z d n e t site. Thanks a lot and keep sharing the information. Keep updating the information for all of us.how can i clean up, because i don???t know why it seems my skeen has to fat i get the glasses dirty every day.i search y a h o o Very good quality indeed. I surely recommend it. The template used in their site is also great.

Reply
Flag

0 Votes

+ -

RE: RealPlayer haunted by 'critical' security holes

MEJIAHA 29th Sep

Fantastic news about the new release.I positively enjoying each little bit of it and I have you b o o k m a r k e d to check out new stuff you weblog post.Im not sure i come to an agreement with you on every level, howevor it absolutely was a good posting, many thanks for taking the time to put up your ideas

Reply
Flag

0 Votes

+ -

RE: RealPlayer haunted by 'critical' security holes

FAULKNE 13th Oct

Good day to confirm this comment I would appreciate T h e b e s t o f Z D N e t d e l i v e r e d your website very nice to everyone Yes, Oracle is the only one with shared-disk architecture, but that is there advantage. It means you can add or remove nodes and the database lives on. In a shared nothing architecture, if you lose a node, you lose the system. I'm sure Oracle appreciates EMC highlighting their advantage.I also desire to signal in your RSS feeds. Thank you as soon as once again and maintain up the great operate Awesome post! Thank you very much || thanks for nice content this is really benefit to me.