RSSReal Patches Critical Flaws in Player
By Nate Mook | Published June 24, 2005, 10:54 AM
RealNetworks on Thursday issued an advisory detailing four security flaws in its RealPlayer software and earlier versions of its Rhapsody music store. The most critical of the holes could give an attacker full control over a user's computer, the company said. Linux versions of RealPlayer are also affected.
Three of the flaws can be exploited using a malicious media file, such as RealMedia or AVI, which causes a buffer overflow in RealPlayer and the potential execution of arbitrary code. A malicious MP3 file could be used to overwrite local files or launch an ActiveX control.
The fourth vulnerability involves an attack creating a malicious Web site that could cause a local HTML file to be created and then trigger an RM file to play which would then reference this local HTML file.
RealNetworks said it has received no reports of machines compromised as a result of the vulnerabilities, but encouraged users to upgrade immediately. The company detailed versions of its software that are affected, and has provided step-by-step instructions for checking if a user is vulnerable.
The latest security problems follow a similar vulnerability exposed in March that opened the door to infected SMIL or WAV files executing arbitrary code using RealPlayer. Real also experienced the same problems in October 2004 with malicious movie files.
Eventually REAL will fade into the bowels of yesteryear. It really needs to. Especially now that more sites are switching to flash video, whats the need?
Score: 0
|I aggree with all the comments here so far, RealPlayer had potential, I used to use there players awhile back now and was firstly happy with there program... however it was soon clear that there seemed very few updates to the program (security patches here and there) but the actual program updates where rare of the same player with the number scrubbed and replaced with a new one. I was thinking maybe Real are working on a major update which would have better preformance (which took ages just to load the player) but I was mistaken. It seems Real were focusing on putting in adware everywhere you clicked in the player, there focus was more on making money for subscriptions than their majority of normal users, who were not going to pay extra money for a feature which you could get elsewhere. There focus also seems to be on internet content for the player rather than the player itself, as you will see on there website, the program itself is not advertised half as much as the content you will recieve... '25,000 radio stations, movie traliers etc'. My opinion Real has become useless and unnecessary, whislt focus on the content they have forgoten the player which runs the material is out of date and not needed.
If you want to play real media content just get RealAlternative, dont add uneeded junk to your pc. Maybe one day they will figure it out, or even better, yes just go out of buisness :)
If you ask me Real still hasnt woken up to the real world
Score: 0
|*Stands up and claps*
Score: 0
|Whenever I see a group of people beating up on RealPlayer I can never resist the urge to join in - they always had a good product that was ruined right from the word go by the company's self-defeating ambitions of world-domination through nagging and spamming. Fact is they could have overtaken Quicktime by now if they hadn't behaved like such a bunch of a****les.
Score: 0
|Real Player , plain and simple (THEY SUCK!)
if you remember, they were the ones that started all the Adware in their software. Because of that, I hope they go under. Realnetworks have no real value to any of the better applications in the audio/video arena out there.
gawd21, you hit right on the nose. I'm with you buddy!
"Real just needs to go out of business"
To Aires, sorry to disapoint you, When you get used to a program, i can understand, it would be hard to change to a better software out there. Musicmatch makes a better Appz than Realplayer. I only use WMP version7 (hack version) to open up any management rights and Yepp studios for all other simple enjoyment.
Anyways, we all have our preference, most will tell you not to go with Real.
go to www.download.com for up to date new releases of new audio/video players other than Real.
Score: 0
|Real just needs to go out of business!!!
Score: 0
|I'm a big fan of RealPlayer but why the hell is it still patching critical flaws?? What the hell's going on?!
Score: 0
|