Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

RealPlayer Zero-Day Flaw Under Attack

Posted by Zonk on Fri Oct 19, 2007 04:22 PM
from the my-kingdom-for-a-patch dept.
Security IT
openOption writes "ZDNet is reporting that hackers are actively exploiting a zero-day hole in RealNetworks' RealPlayer media player, a software program installed on tens of millions of Windows computers worldwide. The in-the-wild attacks targets a previously unknown and unpatched ActiveX vulnerability in the way RealPlayer interacts with Microsoft's Internet Explorer browser. The flaw is causing drive-by malware downloads when an IE user simply browsers to a maliciously rigged Web page."
+ -
story

Related Stories

Submission: RealPlayer Zero-Day Flaw Under Attack by Anonymous Coward
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

RealPlayer Zero-Day Flaw Under Attack 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Installed by millions... (Score:5, Funny)

    by Anonymous Coward on Friday October 19 2007, @04:23PM (#21048545)
    Used by no one... until now.

  • Good thing I don't use Real (Score:2, Funny)

    by Anonymous Coward
    Greased up Yoda doll
    Puckered anus
    GO LINUX!

  • SOFTWARE PROGRAM!!!11111```oneone (Score:5, Funny)

    by Anonymous Coward on Friday October 19 2007, @04:23PM (#21048551)

    a software program

    I like software programs. They run well on my computer PC and look nice on my display monitor. My computer PC works well, all the way from the electric power cable to the Ethernet network card, the hard disk hard drive, and my wireless keyboard keyboard and mouse mouse.

    (What are synonyms for keyboard and mouse?)

    • Oh, relax.... (Score:5, Funny)

      by Foerstner (931398) on Friday October 19 2007, @05:45PM (#21049813)
      You seem to be inexplicably tense. Perhaps you should relax for a while and watch a television program.

      Or go to the theater, and watch a play. If you have any trouble understanding it, you might find more in the program they give you. Hold on to it, they're collectible.

      Whatever you do, though, don't rely on alcohol to relieve your anxiety. If you become dependant on it, you may need a twelve-step program to get yourself back on track.

    • a software program
      As opposed to a hardware program used by something like a Jacquard loom, presumably....
    • "Alphanumeric keyboard" and "computer mouse"?

  • Whew! (Score:4, Interesting)

    by dedazo (737510) on Friday October 19 2007, @04:24PM (#21048557) Journal
    God, I'm so glad I bought a computer with Windows XPN, which thanks to the wisdom of the European Union and RealNetworks' claims of unfair competition against their cuasi-malware player, does not include Windows Media Player! Yes, instead the OEM installed... oh, wait. They installed RealPlayer. Holy sh #$!@&*^} NO CARRIER
  • I don't want to be a troll, but people who install Real Player are asking for trouble.
    Wow, I just had a scary thought I managed to block just in time before passing out: Real Player. On Vista.

    • Re:Hackers are the least of their troubles... (Score:4, Funny)

      by Dishevel (1105119) on Friday October 19 2007, @04:48PM (#21048963)
      I love Real Player. Its icon is pretty and when I click on some things on the internet it works sometimes for me. If it dose not work I just figure that the people putting that bad stuff on the internet must not know what a wonderful company Microsoft is for people like me. Now if you will excuse me I need to click on something real fast so AOL doe not disconnect me again. All I need is MS programs that I can use while online with AOL with my wonderful CABLE COMPANY connection to the internet.
      • For some reason, it can still be popular on various news sites and so on, so yes, people hence use it. I guess Real simply give them some irresistible deals, because surely they aren't stupid enough to willingly use that format? I can admit that the most modern Real formats are pretty good, but the standalone player and all that isn't.

        • Re:Hackers are the least of their troubles... (Score:4, Interesting)

          by Angostura (703910) on Friday October 19 2007, @05:38PM (#21049717)
          I can't speak about the windows version, but the OS X implementation of the free player is actually very nice to use indeed: fast and lightweight. It's the format I choose for listening to and watching BBC streaming feeds.
            • Good luck installing the file manager. Yeah, that'll get you real far. It'd be like yanking the Finder out of my Mac (which has not and never will have a problem with this flaw...)

  • Not in Vista (Score:4, Informative)

    by El Lobo (994537) on Friday October 19 2007, @04:26PM (#21048601)
    The vulnerability doesn't affect IE in protected (sandboxed, default) mode on Vista, of course.

  • Experts Quickly Noted However.... (Score:5, Funny)

    by rel4x (783238) on Friday October 19 2007, @04:28PM (#21048641)
    ...that the viruses using this attack were still easier to uninstall than RealPlayer itself.

  • Video press release (Score:5, Funny)

    by operagost (62405) on Friday October 19 2007, @04:39PM (#21048839) Homepage Journal
    Real has posted a video press release on this. I would like to tell you more, but it's still buffering. Maybe they should use Media Player for their press releases.
  • It's going to take a while for the virus to stop buffering....

  • Real Alternative (Score:4, Informative)

    by gravis777 (123605) on Friday October 19 2007, @04:40PM (#21048849)
    http://www.free-codecs.com/download/Real_Alternative.htm [free-codecs.com]

    Now I just have to worry about unpatched holes in Windows Media Player!

    Truthfully, I already have one bloated Media Player that is part of the OS on my machine, why would I want to install another?

    BTW:
    http://www.free-codecs.com/download/QuickTime_Alternative.htm [free-codecs.com]
    To take care of that OTHER bloated media player
  • New marketing name -> RealTrojans (or viruses/worms, whatever). Sales are UP!
  • All 5 people who still have Real Player installed are in for a world of hurt...
  • The flaw is causing drive-by malware downloads when an IE user simply browsers to a maliciously rigged Web page.

    I like the use of the word browser as a verb.
    Also, drive-by malware downloads? This hood is no longer safe, yo!

  • Please, no more stupid verbs-nee-nouns.

    "Blog" should have been smothered in the crib, let's not loose another monster.

  • Last time I saw real player was when I installed google pack on a windows machine years ago. I love picasa and google earth, and at the time a few of the other packages seemed like nice things to get all in 1 install. Real player was the deal killer- I never could figure out what good it was. It seems like it spent more of my time and CPU cycles trying to sell me on an upgrade than doing anything useful. What was/is google thinking on that one?
    • Ug, Picasa sucks. I still can't figure out what it really DOES. When I installed it I couldn't get it to do a single thing.
  • The evil Realplayer is still required for some MIT open courseware. They should convert those files ASAP.
    • And what about Netscape plugins? This is not "download ActiveX controls on demand" which was chastised and basically isn't around anymore. This is the fact that some apps on your machine say "hey, I know how to handle some data on the net, just load this dynamic library of mine and hand it the data, and I'll render it neatly in the browser".
      • With ActiveX anyone can make something automatically execute.

        With Firefox's plugin search there is a predefined list.

    • Re: (Score:2, Interesting)

      by Anonymous Coward
      This vulnerability has nothing to do with ActiveX. ActiveX is just one method of hosting a plugin. Any method of hosting a plugin would be exactly as vulnerable. Anytime a browser accepts data from an outside source and passes it onto a library to handle that is a possible point of attack. There have been plenty of vulnerabilities found in non-ActiveX plugins for Internet Explorer and other browsers. There have been vulnerabilities found in the very libraries used by the browsers to display common cont
    • Apparently, the BBC's Iplayer project just announced that they'll also be providing content in Real, because a stack of Linux, Mac, and other software users got extremely upset their content could only be viewed with Windows Media Player. So, it's true that Real is around and will be around for a while, namely to provide an alternative to Windows Media Player.

      Now, if they'd just give up on calling files tagged as .rpm as Real files, and save them as software packages and save me having to use the "save as"

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.