RealNetworks Inc. has announced that a flaw in a component of many of its client systems could allow a remote attacker to execute arbitrary code on the users system.
According to RealNetworks, this issue affects “RealPlayer 8, RealOne Player, RealOne Player v2 for Windows only (all languages), RealPlayer 10 Beta (English only) and ReaPlayer Enterprise (all versions, standalone and as configured by the RealPlayer Enterprise Manager).” The RealPlayer 10 Gold client removes the affected component at installation and is therefore not considered vulnerable.
Users must have, at some time in the past, downloaded the specialized R3T plug-in, which supports “RealText 3D.” If an attacker were to exploit the vulnerability successfully, he or she could, minimally, produce a denial of service in the R3T plug-in. It may also be possible for the attacker to execute arbitrary code with the same privileges as the user of the player.
The attacker would have to entice the user to load a malformed file designed to invoke the vulnerability, probably by luring the user to a Web site that contains Real media.
Users of affected versions of Real players can uninstall the affected feature from the same page on which Real describes the problem.
/zimages/5/28571.gifCheck outeWEEK.coms Security Centerat http://security.eweek.com for security news, views and analysis.
Be sure to add our eWEEK.com security news feed to your RSS newsreader or My Yahoo page:http://us.i1.yimg.com/us.yimg.com/i/us/my/addtomyyahoo2.gif