Digital media delivery firm RealNetworks Inc. late Thursday shipped a major security update for its RealPlayer software to patch a pair of remote code execution vulnerabilities.
The security holes, which were reported to RealNetworks more than four months ago, could be exploited by malicious hackers to take complete control over a vulnerable machine.
According to eEye Digital Security, the company that discovered the bugs, the most serious flaw exists in the first data packet contained in a Real Media file.
By specially crafting a malformed “.rm” movie file, a direct stack overwrite is triggered, and reliable code execution is possible.
Affected software include RealPlayer 8, RealPlayer 10, RealOne Player v1, RealOne Player v2, RealPlayer Enterprise (Windows): RealPlayer 10 (Mac); RealPlayer 10 and Helix Player (Linux).
A second flaw, confirmed as “high risk” by RealNetworks, can allow a RealPlayer skin file (.rjs extension) to be downloaded and applied automatically through a Web browser without the users permission.
A skin file is a bundle of graphics and a .ini file, stored together in ZIP format. DUNZIP32.DLL, which is included with RealPlayer, is used to extract the contents of the skin file.
When RealPlayer processes a zip file, it will allocate the field of the file, but when it is copied it will rely on real unzip content to copy, eEye explained in an advisory.
“An attacker can zip one file that has hostile data and create a .rjs file. [The attacker] can change the file length field of .rjs file so when it processes [the] zip file, it will cause a heap overflow,” the company warned.
RealNetworks recommends that users apply the appropriate RealPlayer patches urgently.
The patch is available via the “Check for Update” menu item under Tools on the RealPlayer menu bar.
