Flaw in RealPlayer Client Could Allow Remote Attack

By Larry Seltzer  |  Posted 2004-04-07 Print this article Print

Buffer overflow could allow malicious Web site to send commands to user to be executed by Real client software.

RealNetworks Inc. has announced that a flaw in a component of many of its client systems could allow a remote attacker to execute arbitrary code on the users system. According to RealNetworks, this issue affects "RealPlayer 8, RealOne Player, RealOne Player v2 for Windows only (all languages), RealPlayer 10 Beta (English only) and ReaPlayer Enterprise (all versions, standalone and as configured by the RealPlayer Enterprise Manager)." The RealPlayer 10 Gold client removes the affected component at installation and is therefore not considered vulnerable.

Users must have, at some time in the past, downloaded the specialized R3T plug-in, which supports "RealText 3D." If an attacker were to exploit the vulnerability successfully, he or she could, minimally, produce a denial of service in the R3T plug-in. It may also be possible for the attacker to execute arbitrary code with the same privileges as the user of the player.

The attacker would have to entice the user to load a malformed file designed to invoke the vulnerability, probably by luring the user to a Web site that contains Real media.

Users of affected versions of Real players can uninstall the affected feature from the same page on which Real describes the problem.

Check out eWEEK.coms Security Center at http://security.eweek.com for security news, views and analysis.
Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page:  
Larry Seltzer has been writing software for and English about computers ever since—,much to his own amazement—,he graduated from the University of Pennsylvania in 1983.

He was one of the authors of NPL and NPL-R, fourth-generation languages for microcomputers by the now-defunct DeskTop Software Corporation. (Larry is sad to find absolutely no hits on any of these +products on Google.) His work at Desktop Software included programming the UCSD p-System, a virtual machine-based operating system with portable binaries that pre-dated Java by more than 10 years.

For several years, he wrote corporate software for Mathematica Policy Research (they're still in business!) and Chase Econometrics (not so lucky) before being forcibly thrown into the consulting market. He bummed around the Philadelphia consulting and contract-programming scenes for a year or two before taking a job at NSTL (National Software Testing Labs) developing product tests and managing contract testing for the computer industry, governments and publication.

In 1991 Larry moved to Massachusetts to become Technical Director of PC Week Labs (now eWeek Labs). He moved within Ziff Davis to New York in 1994 to run testing at Windows Sources. In 1995, he became Technical Director for Internet product testing at PC Magazine and stayed there till 1998.

Since then, he has been writing for numerous other publications, including Fortune Small Business, Windows 2000 Magazine (now Windows and .NET Magazine), ZDNet and Sam Whitmore's Media Survey.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel