Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Bug

Three Vulnerabilities Discovered in Real Player 286

Posted by CowboyNeal from the playing-for-a-fool dept.
prostoalex writes "British Next-Generation Security Software discovered three vulnerabilities in popular Real Player. A malicious attacker can execute arbitrary code by offering corrupted RealAudio stream. Real Networks posted the instructions on dealing with security flaws."
This discussion has been archived. No new comments can be posted.

Three Vulnerabilities Discovered in Real Player More

Three Vulnerabilities Discovered in Real Player

Comments Filter:

  • A new insult... (Score:5, Funny)

    by Lord_Slepnir ( 585350 ) on Friday February 06, 2004 @12:42AM (#8198564) Journal
    "Your band's so bad that their voices hack real player"

  • I miss Progressive Networks... (Score:5, Interesting)

    by LostCluster ( 625375 ) * on Friday February 06, 2004 @12:42AM (#8198568)
    When the company was called Progressive Networks, they put out some of the most revolutionairy software on the Internet... software that could make decent sounding realtime talk radio streams with just 14.4kbps of modem bandwidth to work with. When 28.8kbps modems came out, they came up with a codec good enough for most FM radio stations...

    But, oh how the mighty have fallen. The RealNetworks of today stopped advancing their audio protocols long ago, and have sense been lapped by the field of other audio standards. Now, RealNetworks is more of a content company, selling "-Pass" products that create monthly fees to access streams that used to be free.

    So, I guess I'm not surprised that there's a "lazy programmer" style security flaw in their products today. They stoped being a tech innovator, and have slid over into the category of a content pusher. Oh well... another .com bites the dust.

    • Re:I miss Progressive Networks... (Score:5, Interesting)

      by wankledot ( 712148 ) on Friday February 06, 2004 @12:58AM (#8198670)
      Very well said.

      It's very sad for me to see what's happened to Real. I worked there for over a year recently, and I really wish they could turn things around move back to what they did well back in the day.

      They need to:
      1) fire the entire marketing team. They're horrible
      2) lose any of the quick-money things they do (ads, tricking people into paying for the Plus player or *pass accounts) and focus on rebuilding a quality user base.
      3) Throw away all the 325 million customer records they have, and stop the spam.
      4) Own up to the fact that most people hate them, and the only users that don't have a problem with Real are the ones that don't know them well enough yet. You can only burn so many users until they come back to burn you.

      The saddest thing is that the people who work there genuinely care. They are really talented, and they all know what they SHOULD be doing in order to succeed. Especially the people that work on the actual player. But things can't change until the word comes down from the top. Rob needs to have an epiphany and turn the ship around fast, otherwise they'll be selling what's left to Sony and AOL.

      • Re:I miss Progressive Networks... (Score:5, Informative)

        by LostCluster ( 625375 ) * on Friday February 06, 2004 @01:21AM (#8198796)
        Well, the old RealAudio business model didn't work. Give away the client-side software and charge for the encoders... well, eventually people stopped buying the encoders because they realized that nobody could make money streaming content on the Internet for free.

        Rather than fold, Real adapted into a pay-for-content distributor. Not only did they provide the tech to stream content, but they provided the structure with which the content owners could charge for the right to hear the stream, and Real and content owners split the profits.

        But that basically makes them no better than a cable TV company, who is more interested in collecting the money than providing perfect service. Afterall, for most of the content Real is selling, it's take it or leave it offers... Real is the only place you can get certain major sports and news content.

        I guess the free streaming content of the 1999 era was too good to have lasted...

      • Re:I miss Progressive Networks... (Score:5, Funny)

        by Bombcar ( 16057 ) <racbmob.bombcar@com> on Friday February 06, 2004 @02:21AM (#8199001) Homepage Journal
        Today's Dilbert is strangely appropriate...

        Read [comics.com]

    • Re:I miss Progressive Networks... (Score:5, Insightful)

      by orthogonal ( 588627 ) on Friday February 06, 2004 @01:07AM (#8198725) Journal
      So, I guess I'm not surprised that there's a "lazy programmer" style security flaw in their products today.

      Lazy programmer? Abashed, ashamed, depressed programmer is more like it.

      Real is so widely reviled -- by techies, hell, by anyone who has ever downloaded it -- that I'm sure a large number of Real's programers are dispirited, depressed, and resentful that management turned what had been a reputation for technical innovation into a reputation for deceptive marketing practices.

      Once a programmer has dragged his ass into Real in the morning only to be told for the tenth week in a row to forget codec improvements, it's time to hide another five opt-out click boxes on a drop-down list at the bottom of narrow scroll pane behind a button on the third page on a fifteen page tab dialog, it's no surprise that even if he does get to patch the codecs, he won't be doing anything near his best work.

      • Re:I miss Progressive Networks... (Score:4, Interesting)

        by pla ( 258480 ) on Friday February 06, 2004 @03:09AM (#8199144) Journal
        it's time to hide another five opt-out click boxes on a drop-down list at the bottom of narrow scroll pane behind a button on the third page on a fifteen page tab dialog

        Yeah? What do most of us care? They can probe and prod me to their hearts' content - I'll provide as much fake data as they want to ask me for.

        And if they eventually adopt some form of email verification (like mailing a registration key, or the like), well, I can provide as much fake information as Yahoo asks for, as well. Minor inconvenience, but, we all have to do our part to keep the economy flowing smoothly.


        I just don't get all you privacy freaks. Really, it doesn't take that much effort to lie to a few simple questions. Grow up.

        • Re:I miss Progressive Networks... (Score:5, Insightful)

          by gnu-generation-one ( 717590 ) on Friday February 06, 2004 @08:31AM (#8200305) Homepage
          "I just don't get all you privacy freaks. Really, it doesn't take that much effort to lie to a few simple questions. Grow up"

          You lie to protect your privacy, yet verbally abuse those who take their own privacy seriously and dislike lying?
        • I just got tired of supplying the fake data every time I had to do an install, especially after they stopped accepting "webmaster@real.com".

          Seriously, it doesn't seem to be a major privacy issue, just the annoyance of being continually marketed to for something you know you don't want to buy. And I'll confess, I actually bought the commercial version of their current player. But even after you pay them, they come back for more; there's always some damned popup in the system tray telling you that you want

        • > I can provide as much fake information as Yahoo asks for, as well.

          Instead of abusing free services, why not use some free throw-away [spamgourmet.com] e-mail addresses. It's precisely what the service was designed for, and it's free, easy to use, and works well.

    • What about the GSM encoding?

      libgsm1 [debian.org]

      This compresses talk stream down to 1.6kB/s (or 13kbits). From their readme file:

      GSM 06.10 13 kbit/s RPE/LTP speech compression available
      -----------

      The Communications and Operating Systems Research Group (KBS) at the
      Technische Universitaet Berlin is currently working on a set of
      UNIX-based tools for computer-mediated telecooperation that will be
      made freely available.

      Isn't this much better than some close-source codec? Real probably uses GSM for that 14kbps

    • So, I guess I'm not surprised that there's a "lazy programmer" style security flaw in their products today.

      Fix your buffer overflows here:

      Better String Library [sf.net]

      Its guaranteed to plug all your buffer overflows or your money back! Using Bstrlib will make your code shiny and clean! Its brightens your whitespace, and is syntax coloring safe! Yo Quiero Bstrlib! Faster than a speeding bullet! Better than a superbowl halftime show! Free Limited time offer!

      (To opt out of this list click here [pobox.com])

  • Instructions (Score:5, Insightful)

    by DarkHelmet ( 120004 ) * <.mark. .at. .seventhcycle.net.> on Friday February 06, 2004 @12:43AM (#8198575) Homepage
    Here are some nice instructions on how to deal with Real Player's security flaws:
    1. Click Start, go to Control Panel
    2. Click Add / Remove Programs
    3. Find the program entitled RealPlayer, and uninstall it
    4. Run Adaware to make sure any spyware they might have installed is no longer on your machine
    5. Convince people to Use [slashdot.org] better [xiph.org] alternatives

    I still hate RealPlyaer. Any sort of file format that requires me to install the company's software to use I will eternally hate, regardless of who it is. I hate Real, and I hate Quicktime. I'd ask that they both die a slow miserable death, but I honestly want them both out of the way so that more open standards will take their place faster.

    • Re:Instructions (Score:3, Interesting)

      by LostCluster ( 625375 ) *
      Right now, RealPlayer is a program you use when you half to. For open standards, there's a better program out there, but there is a lot of content out there that is only available if you pay for it through RealNetworks, and then you can only watch it if you use one of Real's products.

      If you want to get the web access to major sports or news content that used to be free, you need Real's products and have no way around it...

      • Re:Instructions (Score:5, Interesting)

        by MoonFog ( 586818 ) on Friday February 06, 2004 @12:56AM (#8198657)
        For some time RealPlayer was the only "free" plug-in to support SMIL [w3c.org]. Fortunately, we now have Ambulant [www.cwi.nl].

        There are still, like you mentioned, several places which offer .rm formats to view their contents. Annoying, but then again, it appears only Quicktime and WMV are the alternatives.

      • Re:Instructions (Score:5, Funny)

        by Anonymous Coward on Friday February 06, 2004 @01:13AM (#8198762)
        RealPlayer is a program you use when you half to.

        I wouldn't even use it if I third to.

        • I wouldn't even use it if I third to.

          And it shall get no quarter from me!

      • Your Alternative is ... (Score:5, Interesting)

        by Poligraf ( 146965 ) on Friday February 06, 2004 @02:16AM (#8198987)
        ... Microsoft Monopoly.

        The thing is that Real does not have a source of income. Thus, they need to squeeze pennies out of every possible opportunities often not playing nicely (I mean charging for crap, ads and SPAM).

        At the same time, every format owner is trying to make his one a default. Not supporting Real means that their "commercial" format will die causing all contents providers switch to .WMV that looks like "the default choice" for many.

        It is the repetition of the browser wars.

        BTW, I avoid most of their crap by using older version (revision 6.0.6) of the RealPlayer.

    • Re:Instructions (Score:3, Interesting)

      by Kris_J ( 10111 ) *
      All streaming media companies have been spoilt by broadband -- thusly, in areas with poor broadband take-up rates streaming media is all but abandoned.
    • I just had absolutely no clue that people shared my thoughts on such matters...

      I too would like a slow painful death for Real, but I want them gone and not used as soon as possible.

      Not that I listen to them but I was overjoyed when I heard that click and clack(I dont listen so I don't know how to spell it) had dropped the real audio format for thier show archiving.

      I wish more people would take a cue from this and drop it at least in favor of WMA(it may suck but I can play it on winamp). Something, anythi

    • Re:Instructions (Score:2, Interesting)

      by CoolMoDee ( 683437 )
      We have three "standards" out there. Real, WMV, and Quicktime. The first one sucks like you said because of the software, but they support* odd platforms (Linux/PPC/Alpha). The second is very closed like the first, but is that of a convicted monopoly, and is generally full of drm, and only supports Windows/Mac. The third is mpeg-4 based (an open standard), "requires" their software on Windows, but shold be playable in MPlayer, it also works very well on non-supported platforms (linux). If Quicktime died, th

    • Re:Instructions (Score:2, Insightful)

      by myrdred ( 597891 )
      Ack, it's people like you who give WMP its monopoly. People like you on whom Microsoft depends to use all the bundled software, since you are unwilling to download any alternatives!
      • since you are unwilling to download any alternatives

        Like winamp?

      • Ack, it's people like you who give WMP its monopoly. People like you on whom Microsoft depends to use all the bundled software, since you are unwilling to download any alternatives!

        I agree with you, but so what? Aside from the allegely evil DRM scheme that I haven't even noticed on anything I've ever used MediaPlayer for, I can't see anything wrong with it. Yes, it's bundled, but why should I have to pay for something that ought to come with the operating system? Sure, it may be a monolopy, but it's a
    • Someone's bound to point this out, might as well be me.

      There has been significant development on "alternative codec" to both Real and Quicktime. Google for "Real alternative" or "Quicktime alternative" to find the codecs. They can also be downloaded in a "bundle" of sorts from here : http://www.k-litecodecpack.com/

      I've used the quicktime one with Media Player Classic and have been very happy with it.

      I kind of despise Real player, and rarely find any good content that uses it, so I haven't actually wa

      • Re:Instructions -- Alternative Codecs (Score:2, Informative)

        by Anonymous Coward
        This is not informative, this is misinformation. Real alternative and Quicktime alternative don't give you alternative codecs but alternative players that use the original codecs.
      • > There has been significant development on "alternative codec" to both Real and Quicktime. Google for "Real alternative" or "Quicktime alternative" to find the codecs. They can also be downloaded in a "bundle" of sorts from here : http://www.k-litecodecpack.com/

        I, too, use Media Player Classic on my winboxen.

        But because MPC merely uses the Real codecs, what if the vulnerability is in the DLL for the codec, not the player?

        MPC could be as vulnerable as RP8 or RealOne, at least until we figure o

    • Re:Instructions (Score:2, Insightful)

      by dbCooper0 ( 398528 )
      I hate Real, and I hate Quicktime. I'd ask that they both die a slow miserable death, but I honestly want them both out of the way so that more open standards will take their place faster.

      I Agree wholeheartedly. I had to install from an old copy of RP8 just to watch video from washingtonpost.com because of the inability of RP10 to install properly on my box. I consider myself lucky to have found the install file on another box in my office. They and QT both suck, but they are necessary evils to get th

    • I hate Real, and I hate Quicktime. [ . . . ] I honestly want them both out of the way so that more open standards will take their place faster.

      Quicktime is a wrapper, not a file format. As such, it supports open standards. [apple.com]

  • The fine print (Score:4, Interesting)

    by Anonymous Coward on Friday February 06, 2004 @12:43AM (#8198576)
    "we cannot guarantee and do not warrant that the operation of any RealNetworks product will be error-free, uninterrupted or secure."

    Thanks, I needed that.

  • Great, Just %$*# Great! (Score:4, Funny)

    by l0ungeb0y ( 442022 ) on Friday February 06, 2004 @12:44AM (#8198580) Homepage Journal
    Now if email virii wasn't my only worry, now I can't even trust my daily dose of porn!

    What's the world coming too?
    YAAAAAAaaaaaarrrrgh!!!!

  • "LOLOLOLO!!!!11 j00 h4v3 b33n HAC....buffering.....buffering....buffering...."

  • Shades of MS? (Score:5, Funny)

    by Ignorant Aardvark ( 632408 ) <[moc.liamg] [ta] [syewedyc]> on Friday February 06, 2004 @12:45AM (#8198587) Homepage Journal
    From the Real Player Knowledge Base:

    To prevent maliciously formatted video streams from providing a backdoor into your system, type the video stream by hand and verify that it contains no malicious code.

  • I love the disclaimer... (Score:5, Insightful)

    by HermesHuang ( 606596 ) on Friday February 06, 2004 @12:45AM (#8198588)
    Warranty: While RealNetworks endeavors to provide you with the highest quality products and services, we cannot guarantee and do not warrant that the operation of any RealNetworks product will be error-free, uninterrupted or secure. See your original license agreement for details of our limited warranty or warranty disclaimer.
    Essentially, we don't guarantee our product works, but you should still pay us for it. Seems to be the philosophy of many software companies...
    • >Essentially, we don't guarantee our product works, but you should still pay us for it. Seems to be the philosophy of many software companies...

      and that's one of the reasons why they don't deserve to have their products protected by patents (even if software patents weren't a horrible idea anyway)

      at least "real" products are covered by the Sale of Goods Act (UK) etc. to guarantee a certain level of quality - you give a little, you get a little.

      take responsibility or fuck off.

  • Are all RealPlayer versions affected? (Score:3, Interesting)

    by Debian Troll's Best ( 678194 ) on Friday February 06, 2004 @12:45AM (#8198590) Journal
    Often these types of vulnerabilities only affect one platform (and usually Windows), but does anyone know which platforms are affected by this new exploit? Mac OS X and Linux too? Does it make any difference if I used apt-get to install the RealPlayer binary instead of the Real packaged one? I'm in the middle of sealing off RealPlatyer ports on all our organization's firewalls at the moment, but a lot of them are running OpenBSD and we're having trouble keeping them up long enough to edit the firewall config files.

    • Re:Are all RealPlayer versions affected? (Score:5, Informative)

      by radon28 ( 593565 ) on Friday February 06, 2004 @01:25AM (#8198816)
      Troll, but I'll play along.

      From the second link, of all places:

      "Exploit 1" affects RealOne Player, RealOne Player v2 for Windows only (all languages), RealPlayer 10 Beta (English only) and RealOne Enterprise Desktop or RealPlayer Enterprise (all versions, standalone and as configured by the RealOne Desktop Manager or RealPlayer Enterprise Manager).

      "Exploit 2" affects RealOne Player, RealOne Player v2 (all language versions, all platforms), and RealOne Enterprise Desktop or RealPlayer Enterprise (all versions, standalone and as configured by the RealOne Desktop Manager or RealPlayer Enterprise Manager).

      "Exploit 3" affects RealOne Player and RealPlayer 8 (all language versions).
      • And yet the only bugfix offered is for the "Windows version." I'm guessing that "Please contact your Platinum representative or RealNetworks Customer Support for an update." is some sort of secret code for "pony up more dough, or we'll hose your system."

    • Based on the info available, it's a "lazy programmer" flaw (to borrow a previous poster's words). This is to say that a buf overflow (or something of the like) happens such that you can place an arbitrary sequence of bytes on the stack. When those bytes are executed, however, they'd of course have to be native instructions for the given CPU, meaning that the attacker would have had to create he executable sequence for a specific platform.

      So, in nature, the flaws like these are cross-platform (ie, Mac O

  • Yet another reason to not use it, and use this... (Score:4, Interesting)

    by saskboy ( 600063 ) on Friday February 06, 2004 @12:45AM (#8198596) Homepage Journal
    Real Alternative in Media Player Classic [hccnet.nl]. The version I use on XP has some flaws, but it is better than nothing, and I hope doesn't have the same flaws as the REAL Real Player?

    • I think you will have the same vulnerabilities. Media Player Classic simply uses the codecs from Real, so any flaws in the codecs will still be there despite using Media Player Classic. Real Alternative seems interesting though since it lets you install the codecs without having to actually install one of the players. I don't use Windows anymore, but I could use that to get the RealOne crap off my the computers of my family members.
      • Real Alternative is a bundle of Media Player Classic + Real codecs. MPC on its own contains only a splitter and still needs the decoder DLLs. I don't believe it even supports streaming. Maybe from this you can deduce whether or not the vulnerabilities are still there. Right now my brain is fried :)

  • List of vuln [buffering] (Score:5, Funny)

    by QEDog ( 610238 ) on Friday February 06, 2004 @12:47AM (#8198601)
    The specific [buffering] were:
    Exploit 1: To operate remote [buffering] from the domain of the [buffering] opened by a [buffering] file or other file.
    Exploit 2: To fashion [buffering] which allow an attacker to on a user's [buffering]
    Exploit 3: To fashion [buffering] create Buffer Overrun errors.

  • Affects real player alternative too? (Score:3, Interesting)

    by rritterson ( 588983 ) * on Friday February 06, 2004 @12:47AM (#8198606)
    I'm not a programmer, so I have a question for those of you who are.

    Would these same sorts of vulner's apply to Real Alternative [k-litecodecpack.com] too, or does the active X wrapper prevent the hack?
    • The flaws, found by U.K.-based Next-Generation Security Software, can affect RealNetworks' RealOne Player, RealOne Player version 2, RealPlayer 8, RealPlayer 10 Beta, and the company's RealOne Enterprise products. To exploit them, an attacker crafts the data in a media file in a certain way. When people play or stream the corrupted file in a vulnerable version of RealPlayer, the attacker's code will run, compromising the PC.
      The vulnerabilities are in the player, not the codec it seems.

    • Re:Affects real player alternative too? (Score:5, Informative)

      by LostCluster ( 625375 ) * on Friday February 06, 2004 @12:59AM (#8198673)
      An ActiveX wrapper in its base defintion offers no protection from this kind of flaw... in simplistic terms, ActiveX is a standard by which a controling program links up to other pre-programed objects which exist either inside a .dll file, or posibly even inside a free-standing .exe file that could possibly be run on its own... if the underlying object contains a flaw, then every other program that refers to that object will end up inheriting that flaw in the same situations, it'll be the same code making that same mistake actually running.

      However, since Real Alternative is a reverse-engineered program, it's highly doubtful that they failed to check the same buffer that Real failed to check, so it's unlikely they have the same flaw in their code. If the Alternative has the same bug, then it starts to be likely they stole the code... let's hope we don't have to go there.

      • Wrong (Score:2, Insightful)

        by Anonymous Coward
        Real Alternative is a reverse-engineered program

        No, its simply an ActiveX wrapper for the original Real dll's, nothing is reverse engineered

        then it starts to be likely they stole the code
        from where ?
        even Real's pseudo-open-source helixcommunity.net the non important gui crap is open but the codecs (the important bit) are still very much closed source and binary format only, so no stealing code as there is none to steal

        so yes Real alternative contains this flaw, but if you want to patch it by installin
  • I still haven't gotten past configuring my message center options in Real Player. Boxes keep popping up. I've bought the full version three times now. What's wrong?

  • Conspiracy (Score:4, Interesting)

    by Anonymous Coward on Friday February 06, 2004 @12:50AM (#8198619)
    here's an idea.

    say you have just written a nice little piece of "value-adding" code, say you work at Real, say your boss likes it and would like for every Real customer to have it.

    Both of you would know that a person like me keeps Real Player on my computer only for those "must have real" moments and want nothing further to do with Real.

    Well, well, well, how can they get me to "upgrade" to their new "spyware" (tin foil here)? That's right - hire a 3rd party to "find" very, very nasty bugs...then claim to have THE SOLUTION!!!! Get the NEW version....with the crapware!!!
    br.horyryaryyaryaryyy!!!

  • The thing is... (Score:5, Funny)

    by teamhasnoi ( 554944 ) <teamhasnoi@yahoo.cLIONom minus cat> on Friday February 06, 2004 @12:56AM (#8198660) Journal
    in order to execute the exploits, you first have to click on thirty-seven checkboxes hidden in a Tibetian monestary.

    Then you must send 34 seconds of a certain portion of the movie 'Deliverance' over a period of 22 minutes.

    These two things must be accomplished while repeatedly hitting 'alt-f4' on your keyboard, and screaming, "Damn you Real Player! Damn you to Hell!' like a woman.

    Of course, if you reboot you'll have to start all over again, after a slight delay.

    Um, a longer delay.

    Ok, you get one shot at this, I guess. At least the exploit is consistent with their user interface.

    • You forgot one important step: You must first attempt to to connect to ports 1026, 1027, 1029, 1034, 1026, 1044 and 1035 in that sequence within 5 seconds.
    • These two things must be accomplished while repeatedly hitting 'alt-f4' on your keyboard, and screaming, "Damn you Real Player! Damn you to Hell!' like a woman.

      That's not an exploit. That's an easter egg.

  • Not on OS X? (Score:5, Informative)

    by ce25254 ( 25706 ) on Friday February 06, 2004 @12:59AM (#8198679)
    It appears from the press release on RealNetworks' site that the vulnerability does not affect the Mac OS X version.

    Hm, once again, nothing to worry about.

    • Re:Not on OS X? (Score:2, Informative)

      by Anonymous Coward
      It is very unclear whether or not this affects OS X versions or not. The comment on Real's site says two of the exploits affect all platforms, but there's no link to a fix for the OS X version.

      What combination of the following does this mean:
      a) The OS X version isn't affected?
      b) The OS X version is affected, but Real hasn't released a fix?
      c) That Real's comment is incomplete?
      d) No one knows?

  • So they want you to get the new version? (Score:3, Informative)

    by enosys ( 705759 ) on Friday February 06, 2004 @01:00AM (#8198684) Homepage
    It seems there are no fixes for old versions and you have to get the latest one. This sucks. I hate getting new RealPlayer versions because you always have to wonder what crap they've added in the next version.

    Has anybody tried Real Alternative [hccnet.nl]?

  • Hmm (Score:2, Funny)

    by Niacin ( 700561 )


    ..and in other news, Real Player now hijacking PC's with a new vulner.....

  • What about Real Alternative? (Score:5, Informative)

    by e40 ( 448424 ) on Friday February 06, 2004 @01:04AM (#8198710) Journal
    I would imagine that it is not affected... perhaps this is a good time to plug it. Get it from here [hccnet.nl]. Just Media Player Classic [sourceforge.net] is also available.

    • Actually, I want to know if anyone knows yet if the exploits affect RealAlternative or not.
      Won't stop me using it, though. 'Cos at least I can stop it from misbehabing and actually deinstall the damn thing if I need to. I don't trust RealOne to even get the latter right.

      Tiggs
    • I don't know about Real Alternative, but I imagine it works similar to MPC in that it uses the original DLLs provided by Real Inc. to display the media content. So if there's a bug/security flaw in those DLLs, it might well translate to a vulnerability in MPC and other programs utilising the Real codecs.

  • POS Software (Score:2, Informative)

    by ToadMan8 ( 521480 )
    I'm sorry but there is simply nothing good about this piece of software. It's sucked since version one and sucks progressively more as time goes on. As a matter of fact Microsoft's wmv and wma kicks the shit out of it and that's saying something.

    I installed "V10" today and unchecked EVERYTHING about internet connections, update checkers, shortcuts, file associations etc and the damn thing still did it anyway. I eventually copied it to my gentoo box and mplayer handled it fine besides not being able to q

  • My predicament... (Score:3, Funny)

    by Anonymous Coward on Friday February 06, 2004 @01:13AM (#8198763)
    [x] I'd uninstall Realplayer, but [insert choice pr0n site] still streams its content with it and I can't be without it.

    Possible Solution: If we can get the pr0n industry to take an interest in OSS, then Linux on the desktop would excel!

  • This one is too easy. (Score:5, Funny)

    by Montreal Geek ( 620791 ) <marcNO@SPAMuberbox.org> on Friday February 06, 2004 @01:40AM (#8198883) Homepage Journal
    Be definition if you have any software from RealNetworks on your box, then a malicious attacker is running arbitary code.

    Spyware, adware, "helpful" browser adjuncts.

    Oh, wait, you mean another malicious attacker!

    -- MG

  • Buffering... (Score:5, Funny)

    by arvindn ( 542080 ) on Friday February 06, 2004 @01:56AM (#8198936) Homepage Journal
    Its ironic that one of the vulnerabilities is a buffer overflow.

  • The Three Vulnerabilities are.... (Score:4, Funny)

    by Viking5150 ( 97471 ) on Friday February 06, 2004 @02:09AM (#8198969)
    buffering.......buffering.......buffering......

  • RealNetworks, Releases Update to Address Security. (Score:3, Informative)

    by Anonymous Coward on Friday February 06, 2004 @02:14AM (#8198984)
    RealNetworks, Inc. has recently been made aware of security vulnerabilities that could potentially allow an attacker to run arbitrary code on a user's machine.

    The specific exploits were:

    * Exploit 1: To operate remote Javascript from the domain of the URL opened by a SMIL file or other file.
    * Exploit 2: To fashion RMP files which allow an attacker to download and execute arbitrary code on a user's machine.
    * Exploit 3: To fashion media files to create "Buffer Overrun" errors.

    While we have not received reports of anyone actually being attacked with this exploit, all security vulnerabilities are taken very seriously by RealNetworks. RealNetworks has found and fixed the problem.

    Affected Software:

    "Exploit 1" affects RealOne Player, RealOne Player v2 for Windows only (all languages), RealPlayer 10 Beta (English only) and RealOne Enterprise Desktop or RealPlayer Enterprise (all versions, standalone and as configured by the RealOne Desktop Manager or RealPlayer Enterprise Manager).

    "Exploit 2" affects RealOne Player, RealOne Player v2 (all language versions, all platforms), and RealOne Enterprise Desktop or RealPlayer Enterprise (all versions, standalone and as configured by the RealOne Desktop Manager or RealPlayer Enterprise Manager).

    "Exploit 3" affects RealOne Player and RealPlayer 8 (all language versions).

    Workaround:

    Dont run our shit.
  • Real Networks have decided to follow Microsoft's lead, and instead of fixing the security flaw (see Microsoft and passwords in http headers) Real Networks have have removed the offending feature.

    The next version of Real Player will have the ability of plaing *.rma and *.rmv files removed to protect end users from the evil internet.

    All users of Real Player are urged to update their player. An email virus^H^H^H^H^H^H will be sent to every registered user containing a patch to be executed as the Administrato

  • Gah! (Score:2)

    by 222 ( 551054 ) *
    Upgrade my old, yet "safe" version of Realplayer, or risk having my box get owned...
    Well, i do backup regularly....

  • "upgrade to the latest" strategy, no real patching (Score:5, Insightful)

    by MMHere ( 145618 ) on Friday February 06, 2004 @04:07AM (#8199280)
    Real's approach has always been to have their latest & "greatest" software running on your PC. ("greatest" software is less well tested).

    So I run RealPlayer8 Basic when I need to. Their fix is to have me replace it with RealPlayer10 Gold? I don't wanna.

    I also don't like having to upgrade to a newer set of local softwares simply because the "file format" has changed. There aren't that many advances in formats/compression over time, and it seems to me that: new formats are released more frequently than necessary, thus "requiring upgrades" to new readers of said formats.

    (A) Patch the buggy apps you still support; don't make us install new (less well tested) software so often;

    (B) Don't tie the desire to distribute your latest code to [often] unnecessary media format changes.

    "I Sam thee to Dayton! (It's worse than Cleveland.)"

  • Helix? (Score:5, Interesting)

    by loconet ( 415875 ) on Friday February 06, 2004 @08:27AM (#8200282) Homepage
    Hey question for you guys, I've seen a lot of negative comments about Real, most of which are understandable as I myself until recently refused to install their bloated software.

    Anyone familiar with the Helix project (www.helixcommunity.org [helixcommunity.org])?

    From the website:


    The Helix community is a collaborative effort among Real, independent developers, and leading companies to extend the Helix DNA(TM) platform, the first open multi-format platform for digital media creation, delivery and playback. The Helix DNA platform is comprised of the following:

    * Helix DNA Client
    * Helix DNA Producer
    * Helix DNA Server
    * RealAudio and RealVideo codecs

    I'm not too familiar with it but is it a step in the right direction for a company that once used to be on the cutting edge of digital media and now is trying to get back in the game? Or is it just another one of their corporate blood sucking tacticts? What are your thoughts?

  • Watch out, with a hole like that someone could install any malicous code. Trojans, spam machines, even Realplay...what? Oh...nevermind.
  • I'm aware of "pain in the ass" RealPlayer and RealPlayer "adware for your spyware only", but I haven't seen the "popular" one yet.

    And I haven't tired of putting "things" in "quotes", either.

  • can't find the free player? neither can "car talk" (Score:4, Interesting)

    by aderusha ( 32235 ) on Friday February 06, 2004 @10:11AM (#8201236) Homepage
    from http://cartalk.com/Radio/windowsmedia-switch.html [cartalk.com]:

    Car Talk will now be available via the Windows Media Player, rather than RealMedia. That's right, we're unceremoniously dumping RealMedia.

    Why? Because, for a long time, we've had tons of complaints about RealNetworks. And the one that ticks us off the most is the perceived trickery they use to sell their premium products. This is just our opinion, mind you, but it's shared by enough of our listeners, that we finally decided to take action.

    Here's the problem. In order to hear our audio, you have to go to Real.com and download their "free" RealPlayer. But when you get to the web site, the free player is harder to find than Osama Bin Laden at night. And the site seems to do everything it possibly can to get you to "buy" a player instead. You have to work very hard to get the free player. And we think that stinks. And get this. It stinks so much that it even makes Microsoft look good by comparison. That's something, huh?

    We've heard from many of our fans that have been duped, and who have accidentally shelled out their hard-earned dineros. And we won't even get into the ways that the RealPlayer tries to take over your computer once you install it. So, after surveying the alternatives, we're switching to Windows Media Player (which works on Macs, too).

    For those of you who don't yet have the Windows Media Player installed, you can get it for Windows--for free--at:
    http://www.microsoft.com/windows/window smedia/9ser ies/player.aspx

    And for Mac--for free--at:
    http://www.microsoft.com/windows/window smedia/soft ware/Macintosh/osx/default.aspx for OS X or
    http://www.microsoft.com/windows/windowsmedia/ down load/mac71.aspx for OS 8.1 and up

    Listening to Car Talk is painful enough by itself. You don't need more angst. If you'd rather take Car Talk with you, you can also download the show anytime by clicking on the Audible link at:
    http://www.cartalk.com/Radio/Show/ (Cheapskate alert: fee *definitely* involved.)


    when major broadcasters are dumping real's products due to their "betcha can't find the free version" antics, maybe real would wisen up and actually make good on their "free" players.

    not that i care - real alternative [hccnet.nl] and media player classic [sourceforge.net] take care of my windows-based media viewing just fine, minus all the spyware and other crap.

  • The "Fix" is to upgrade to RealOne -- no thanks! (Score:3, Insightful)

    by WD ( 96061 ) on Friday February 06, 2004 @10:32AM (#8201505)
    The only fact that allowed RealPlayer to remain on my system was that you didn't need to upgrade to the horrible, slow, ad-infested RealOne player. I've had no problem playing any "real" content with RealPlayer 8. It's not the best player, but compared to RealOne it is lean and mean.

    For people using RP8, the "fix" is to upgrade to the latest RealOne player (V2).

    Given those choices, I think any remaining RealPlayer users will choose to uninstall the software.

Slashdot Top Deals

If mathematically you end up with the wrong answer, try multiplying by the page number.

Close