NEWS RealNetworks acknowledged on Wednesday that three flaws affecting different versions of its media player could allow attackers to create corrupt music or video files that, when played, take control of a victim's PC.
The flaws, found by UK-based Next-Generation Security Software, can affect RealNetworks' RealOne Player, RealOne Player version 2, RealPlayer 8, RealPlayer 10 Beta, and the company's RealOne Enterprise products. To exploit them, an attacker crafts the data in a media file in a certain way. When people play or stream the corrupted file in a vulnerable version of RealPlayer, the attacker's code will run, compromising the PC.
By forcing a browser to a website containing such a file, code could be executed on the target machine running in the context of the logged-on user," stated an advisory posted by NGSSoftware.
The vulnerabilities may affect a large portion of the 350 million unique registered users of the media player software, but RealNetworks wouldn't say how many of those people use the vulnerable versions.
"We haven't had any reports of anyone having any issues," Erika Shaffer, a spokeswoman for the Seattle multimedia company, said on Thursday. "However, we take security very seriously and so wanted to get these fixes out."
The flaw can be exploited using a specially crafted media file, which can be one of five types: RealAudio (RAM) file, RealAudio Plugin (RPM) file, RealPix (RP) file, RealText (RT) file or synchronised multimedia integration language (SMIL) file.
Security vulnerabilities that can be exploited through playing a media file have been rare. Last May, a flaw in the way that Microsoft's Windows Media Player handled "skins," or interface colors and motifs, led the software giant to release a patch for that application.
RealNetworks has posted instructions on its website for people to update their RealPlayer software.
Robert Lemos writes for CNET News.com
Comments
There is 1 comment. Join the discussion
1. Phoenix King
Real media is not the first company to be exploited in this manuarism, Windows Media player has had the same flaw for years. After a music video or mp3 file has been played there are sites that it will visit or even install programs like internet optimizer onto your system, creating a pain to remove as that is an adware nuisannace.