RealPlayer Zero-Day Flaw Under Attack

openOption writes "ZDNet is reporting that hackers are actively exploiting a zero-day hole in RealNetworks' RealPlayer media player, a software program installed on tens of millions of Windows computers worldwide. The in-the-wild attacks targets a previously unknown and unpatched ActiveX vulnerability in the way RealPlayer interacts with Microsoft's Internet Explorer browser. The flaw is causing drive-by malware downloads when an IE user simply browsers to a maliciously rigged Web page."

Installed by millions...

Used by no one... until now.

I suppose, it's a buffering ...

overflow exploit, right?

Re:Installed by millions...

From Wikipedia:

A zero-day (or zero-hour) attack is a computer threat that exposes undisclosed or unpatched computer application vulnerabilities. Zero-day attacks take advantage of computer security holes for which no solution is currently available.

Good thing I don't use Real

Greased up Yoda doll
Puckered anus
GO LINUX!

SOFTWARE PROGRAM!!!11111```oneone

a software program

I like software programs. They run well on my computer PC and look nice on my display monitor. My computer PC works well, all the way from the electric power cable to the Ethernet network card, the hard disk hard drive, and my wireless keyboard keyboard and mouse mouse.

(What are synonyms for keyboard and mouse?)

Oh, relax....

You seem to be inexplicably tense. Perhaps you should relax for a while and watch a television program.

Or go to the theater, and watch a play. If you have any trouble understanding it, you might find more in the program they give you. Hold on to it, they're collectible.

Whatever you do, though, don't rely on alcohol to relieve your anxiety. If you become dependant on it, you may need a twelve-step program to get yourself back on track.

Whew!

God, I'm so glad I bought a computer with Windows XPN, which thanks to the wisdom of the European Union and RealNetworks' claims of unfair competition against their cuasi-malware player, does not include Windows Media Player! Yes, instead the OEM installed... oh, wait. They installed RealPlayer. Holy sh #$!@&*^} NO CARRIER

Hackers are the least of their troubles...

I don't want to be a troll, but people who install Real Player are asking for trouble.
Wow, I just had a scary thought I managed to block just in time before passing out: Real Player. On Vista.

Re:Hackers are the least of their troubles...

I can't speak about the windows version, but the OS X implementation of the free player is actually very nice to use indeed: fast and lightweight. It's the format I choose for listening to and watching BBC streaming feeds.

Re:Hackers are the least of their troubles...

Seems simple, just assign the browser ring 3 security. Oh wait, its Windows (and the user is Administrator with no password).

A spammer can still send spam from ring 3. A botnet herder can still run a bot from ring 3. A phisher can still change proxy settings from ring 3.
Ring 0 only adds stealth to attacks that work just fine from ring 3.

Re:Hackers are the least of their troubles...

I love Real Player. Its icon is pretty and when I click on some things on the internet it works sometimes for me. If it dose not work I just figure that the people putting that bad stuff on the internet must not know what a wonderful company Microsoft is for people like me. Now if you will excuse me I need to click on something real fast so AOL doe not disconnect me again. All I need is MS programs that I can use while online with AOL with my wonderful CABLE COMPANY connection to the internet.

Not in Vista

The vulnerability doesn't affect IE in protected (sandboxed, default) mode on Vista, of course.

WARNING MS SHILL

Nobody uses Vista because Vista's not compatible with Windows.

Experts Quickly Noted However....

...that the viruses using this attack were still easier to uninstall than RealPlayer itself.

Re:Experts Quickly Noted However....

Upon attempting to exploit the flaw, the virus was promptly greeted with ...BUFFERING... ...BUFFERING...

Huh.

I had no idea people still use RealPlayer.

Video press release

Real has posted a video press release on this. I would like to tell you more, but it's still buffering. Maybe they should use Media Player for their press releases.

I wouldn't worry...

It's going to take a while for the virus to stop buffering....

Real Alternative

http://www.free-codecs.com/download/Real_Alternative.htm [free-codecs.com]

Now I just have to worry about unpatched holes in Windows Media Player!

Truthfully, I already have one bloated Media Player that is part of the OS on my machine, why would I want to install another?

BTW:
http://www.free-codecs.com/download/QuickTime_Alternative.htm [free-codecs.com]
To take care of that OTHER bloated media player

Re:Real Alternative

http://www.free-codecs.com/download/Real_Alternative.htm [free-codecs.com]
Now I just have to worry about unpatched holes in Windows Media Player!

Actually "Real Alternative" and "QuickTime Alternative" uses ripped off binary libraries straight off the official apps. It's quite likely you're vulnerable as well.

Get with it

New marketing name -> RealTrojans (or viruses/worms, whatever). Sales are UP!

No need to worry! - Screen shot of virus.

You have been infected by a RealPlayer virus! Muahahah! In 5 seconds, your hard drive will be form ...buffering... ...buffering... ...buffering...

Worried? Nah

All 5 people who still have Real Player installed are in for a world of hurt...

browser, -noun, a person or thing that browses

The flaw is causing drive-by malware downloads when an IE user simply browsers to a maliciously rigged Web page.

I like the use of the word browser as a verb.
Also, drive-by malware downloads? This hood is no longer safe, yo!

"Browsers to a maliciously rigged Web page"

Please, no more stupid verbs-nee-nouns.

"Blog" should have been smothered in the crib, let's not loose another monster.

real player still part of google pack (beta)?

Last time I saw real player was when I installed google pack on a windows machine years ago. I love picasa and google earth, and at the time a few of the other packages seemed like nice things to get all in 1 install. Real player was the deal killer- I never could figure out what good it was. It seems like it spent more of my time and CPU cycles trying to sell me on an upgrade than doing anything useful. What was/is google thinking on that one?

Soon to be on Slashdot:

Next up: Spam with attached Realmedia files that redirect to "stock sharing sites."

Real Player still exists??

I remember 'registering' Real Player back in the 90's so they sent me a CD-ROM with the 'paid for' version that had a 'record' button (for those really, really rare instances where a server allowed you to record the stream.)

Is Real Player still around???

it's 2007...

... and people still use Real anything...

Wow.

After that wretched "G2 Phone Home" crap and the whole "tell me who your are so I can spam the hell out of you unless you use a fake email address like '[e-mail]'" crap, I'm really suprised ANYONE uses the stuff. I haven't come across a single site in the last few years that uses Real to stream, and all of my musician buddies stopped encoding in Real format back in 2001 or so.

File this exploit under "does anyone really care?". It's like finding a zero-day exploit for Windows 3.11 or MS Bob.

The Sole User of Real Here

I still use the real player. Really the only reason I do is becuase the 100+ downloaded south park episodes I have from southparkx.net are encoded as .rm files and are better quality (for a 36mb) than anything else. Honestly though, people rip on Real but I think itunes & quicktime (bundled together mind you at 50mb+) is a much inferior product than Real. Apple and Adobe are two of the worst bundling companies out there.

Drive-by?

drive-by malware downloads? good thing I got a MAC

What is ActiveX?

I disabled that on my WinXP a looooooonnnnnnnngggg time ago.

MIT open courseware & Realplayer

The evil Realplayer is still required for some MIT open courseware. They should convert those files ASAP.

Only Zero day flaws?

Sorry buy this post is buffering...

ActiveX in IE

If you disable ActiveX in Internet Explorer, you will not be affected right?

Only affecting badly managed systems

The flaw is causing drive-by malware downloads when an IE user simply browsers to a maliciously rigged Web page

Of course this flaw only affects badly managed systems where the user is browsing the Internet while logged on as an Adminstrator.
Microsoft is trying to discourage this but the users are too stupid to realize what they are doing wrong, and keep adding themselves to the Administrators group and keep trying to get rid of "annoying" popups that tell them they need to supply their password before the system will install software.

Just like a plague.

"a software program installed on tens of millions of Windows computers worldwide"

This is a direct measure of how many people run computers without any actual knowledge and sense of security/efficiency.

The last time I was forced to install the RealPlayer just to watch a piece on a website I was subjugated into a series of humiliating requests: screen after screen the installation process was going to possess all my media, substitute all the other legit players and link all the way possible into some shitty music download service.

As soon as I recorded the piece in another DRM free format I disinstalled that stinky crap and run several scan for spyware because ultimately reaplayer is more a posses-my-pc-experience than a player.

Conclusion: Those people running Realplayer showed they like to be abused by the same act of agreeing to the installation process. They thus deserve to be exploited by hackers. Anyway I guess those same people have been allready running bonzi buddy all this time.

Virus through RealPlayer...

Buggering... Buggering... Buggering...

Re:This just in: ActiveX STILL a bad idea...

And what about Netscape plugins? This is not "download ActiveX controls on demand" which was chastised and basically isn't around anymore. This is the fact that some apps on your machine say "hey, I know how to handle some data on the net, just load this dynamic library of mine and hand it the data, and I'll render it neatly in the browser".

Re:This just in: ActiveX STILL a bad idea...

All to true! A while back [adult swim] used to require activex to watch watch their videos on line. They kicked that to the curb since they realized that their demographic is the same demographic that is most likely to not use IE/ activex! They got the picture so should every one else!

Re:This just in: ActiveX STILL a bad idea...

This vulnerability has nothing to do with ActiveX. ActiveX is just one method of hosting a plugin. Any method of hosting a plugin would be exactly as vulnerable. Anytime a browser accepts data from an outside source and passes it onto a library to handle that is a possible point of attack. There have been plenty of vulnerabilities found in non-ActiveX plugins for Internet Explorer and other browsers. There have been vulnerabilities found in the very libraries used by the browsers to display common content like images.

This is why the Vista approach is the correct approach: sandbox the browser. The process should be locked down so tight that when a vulnerability is inevitably discovered that the damage it can cause is mitigated. Every OS and every browser needs to incorporate these mechanisms by default.

1997 called. They want their security alerts back

I remember first reading about activeX security vulnerabilities in one of the O'Reilly nutshell books about website design. The book also covered controversial topics such as the use of the <BLINK> and <TABLE> tags in HTML.

Re:Great. More Patches.

It would be sufficient when your workstations were setup a bit more securely, and you would not be working as an Administrator or Power User all day.
When using a Windows system as a normal user, those exploits do not stand a chance. That would be similar to using Linux as a normal user, not root.

Of course far too many wannabe-windows-admins have yelled "cannot do that, need to be admin to run many programs" because they found that in 2000 and never checked again.

Re:I'm done with Real- Share the Wealth Dude!

Could you please name the tool or provide a link for those of us still streaming Real?