Digital media delivery outfit RealNetworks Inc. on Wednesday released patches for a high-risk security flaw in several versions of its widely deployed RealPlayer software.
The Seattle, Wash.-based company said the flaw could allow an attacker to run arbitrary or malicious code on unpatched machines. “RealNetworks has received no reports of machines compromised as a result of the now-remedied vulnerabilities,” the company said in an online advisory.
Security research company Secunia rates the issue as “highly critical” and urged users to apply the appropriate fixes immediately.
The vulnerability flaw is described as a heap overflow error that occurs when the RealPlayer software handles malformed “.ram” files containing a specially crafted “host” variable.
RealNetworks uses the “.ram” format to compress audio files for streaming over the Internet.
The companys alert said most major versions of its flagship RealPlayer and RealONE software were affected by the vulnerability.
Also affected is RealPlayer Enterprise, the configurable version of RealPlayer designed for enterprise deployments. RealPlayer Enterprise offers an ad-free version for businesses interested in audio and video conferencing software.
The fix for RealPlayer Enterprise is available here.
Other affected versions include RealPlayer 10.5, RealPlayer 10, RealONE Player v2, RealONE Player v1, RealPlayer 8, Mac RealPlayer 10, Mac RealONE Player, Linux RealPlayer 10 and the Helix Player 10.
RealNetworks said patches can be applied via the “Check for Updates” feature from the “Tools” menu on the media player.
Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.
