RSSReal Patches Two Serious Player Flaws
By Ed Oswald | Published November 11, 2005, 11:18 AM
RealNetworks patched two significant vulnerabilities that affect most versions of its Real Player software. One flaw, marked as a "high risk," allows a skin file to be downloaded and applied to the player without the user's permission. The file could contain data that causes a heap overflow, according to eEye Digital Security.
The other more serious flaw involves specially formatted .rm movie files. An attacker could use the file to trigger a direct stack overwrite and thus open up a backdoor to execute malicious code. "RealNetworks has received no reports of machines compromised as a result of the now-remedied vulnerabilities," the company said in an advisory, but pointed out that it "takes all security vulnerabilities very seriously." The patches are available through Real Player's built-in update mechanism.
It's nice to try and support the Open Source community by using programs like Quick Time Alternative and Real Alternative, but even with the latest Real Alternative, it fails to find codecs to support SMIL files. Additionally, it brings up a 404 page when trying to locate the codec for SMIL files with MPC. Had to download real player for the codecs and now Media Player Classic plays SMIL's fine.
Score: 0
|i guess the patches dont appear for the autoupdate...cuz i did a scann...no patches there hmmmm
Score: 0
|So use Real Alternative and avoid Real's player dreck.
next...
Score: 0
|Sadly, real alternative is little more than a pirated (or at least license violating) copy of enough of the realplayer dlls for other media players to be able to play real files. It is not rewritten, or legal. Is it safe to play realplayer files in another media player, with an older version of the dlls? Perhaps, but no guarantees.
Score: 0
|If its so illegal, why don't you friggin dial 911 already, Sir Knowitall.
Score: 0
|I'm pretty sure 911 dosn't do software piracy. I think they are busy saving lives, etc.
Score: 0
|The only patch you need for Real Player is : uninst.exe
Score: 0
|agreed
Score: 0
|that... owned
Score: 0
|I only use RealPlayer with trusted files... I don't just download anything.
But the same problem happens with that M$ s***, WMP.
Score: 0
|Well said.
Score: 0
|