‘High Critical’ Realplayer flaw
p2pnet.net News:- Secunia is reporting a Highly Critical Realplayer/RealOne problem.
The vulnerability, caused by a boundary error when processing RAM files, could be used by a hacker to create a buffer overflow via a specially crafted RAM file, says Secunia, adding that patches are available via the "Check for Update" feature..
Software affected includes:
- RealPlayer 10.5 (6.0.12.1040-1059)
- RealPlayer 10
- RealOne Player v2
- RealOne Player v1
- RealPlayer 8
- RealPlayer Enterprise
- Mac RealPlayer 10 (10.0.0.305 – 331)
- Mac RealOne Player
- Linux RealPlayer 10 (10.0.0 – 3)
- Helix Player (10.0.0 – 3)
===========
Something you think we should know? tips[at]p2pnet.net
<——The Internet ? Is that thing still around ? / Homer Simpson. ——>
See:-
Secunia – Realplayer/RealOne RAM File Processing Buffer Overflow Vulnerability, April 21, 2005
April 21st, 2005 at 9:01 pm
Subject: High Critical Realplayer Flaw.
Abstract: A flaw has been found in Realplayer. This flaw affects all versions.
Problem: Realplayer installs spyware on the compromised computer. This spyware reports unknown information back to Real Networks.
Problem: Realplayer hijacks file associations without clearly explaining to the installer what it is doing.
Problem: Realplayer installs adware on the compromised computer. This adware primarily advertises other Real Networks products and services. Depending on the version installed, this function is bundled with the player, and cannot be disabled.
Problem: Realplayer may install links or other software without the user’s consent, depending on what version is installed.
Solution: Realplayer can be uninstalled without consequence using the Windows uninstaller panel. However, it has been found that Realplayer tends to leave unwanted associations or software behind. There is no know fix for this short of reformatting the machine and reinstalling the OS.
Suggested workaround: DO NOT INSTALL Realplayer. It has been suggested that a combination of “Media Player Classic” and “Real Alternative” will provide a cleaner playback of any data normally handled by Realplayer.
April 21st, 2005 at 9:31 pm
I aways have a problem with the slightly unscruplous programs and their supporters that what to give you something you don’t desire. Add to this the lack of finishing the program with adequate uninstall procedures. Many times it is purposely so that installed spyware won’t get removed with the uninstall. If you ever had any doubt about the player then these sort of practices should tell you stay away. Only problem with this is that mostly you don’t find out till after the fact, unless either you have run into it before or by chance have spoken with someone having to deal with it.
While not to spam for any particular product I would recommend you do a search on the web for a program called VLC if you need a player. It is free, without spyware, and will play almost anything you can throw at it in the line of a music format.
April 21st, 2005 at 9:32 pm
Realplayer=scumware
April 21st, 2005 at 10:42 pm
Realplayer, by nature, is a nasty security hole, always avoid installing it.
search google for a free alternative if you absolutely need to play a .ram/.rm file