Samsung phones only from AT&T
RealPlayer 10 beta, RealOne Player for Mac OS X affected by security issue
eEye Digital Security says it discovered a critical vulnerability in RealPlayer. The vulnerability allows a remote attacker to reliably overwrite heap memory with arbitrary data and execute arbitrary code in the context of the user who executed the player.
A statement reads "This specific flaw exists within the pnen3260.dll file used by RealPlayer. By specially crafting a malformed .rm movie file along with a SMIL file, a direct heap overwrite is triggered, and reliable code execution is then possible."
In the case of Mac OS X, users only vulnerable if they play a local Real media file in either Real Player 10 Beta or RealOne Player.
RealNetworks has since released a patch for this vulnerability. The patch is available via the "Check for Update" menu item under the application menu (RealOne Player) in the menu bar. Real Player 10 (non-beta) is not affected by this issue.
Feedback? Late-breakers@macfixit.com.
Resources
menubar, tells me that my RealPlayer 10 is "up to date," no patch offered for
download.
document
(http://service.real.com/help/faq/security/040928_player/
EN/), RealPlayer 10 for Mac OS X appears to be
unaffected by the vulnerabilities.
The RealPlayer 10 Beta is subject to one of the three
exploits described, however.
D.
- by hamarkus October 5, 2004 3:24 AM PDT
- RealPlayer 10 fixed UI oddities I had with www.bbc.co.uk/worldservice with Mozilla.
- Like this Reply to this comment
-
(4 Comments)But although it fixed some UI problems with www.couleur3.ch, it doesn't play anything there at all anymore (could also be a Java-related problem, i.e. changes on the site or with 1.4.2 Update 2).