RealPlayer flaw: Stop using Internet Explorer

Security experts are warning RealPlayer users to stop using Internet Explorer until a patch is released for a flaw researchers discovered which could allow code execution. Researcher Elazar Broad has posted to the Full Disclosure mailing list a so-called heap overflow vulnerability that makes it possible for an attacker to modify heap blocks after they are freed and overwrite certain registers.

This could allow code execution on a compromised machine. The vulnerability affects all versions of RealPlayer running under Internet Explorer. Exploit code for this flaw has not yet been made public.

Without a patch from RealPlayer, security experts recommend disabling the killbit for the following ActiveX ClassIDs:

  1. 2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93
  2. CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA

However, disabling these killbits will also remove some functionality within the player.

To avoid the loss of functionality, security experts recommend using RealPlayer in a browser that doesn't support ActiveX, such as Mozilla Firefox (for Windows and Mac).

News Source: ZDNet Australia

Report a problem with article
Previous Story

Microsoft says no Blu-ray for Xbox 360

Next Story

Two years after patch, a new IE5/6 FTP flaw

34 Comments

Commenting is disabled on this article.

(Jugalator said @ #21.1)
Because web sites still use Real. I don't know why, they probably give them good (cheap) licensing deals or something.

Unfortunately the BBC still insists on using real player for some things on their website, although thankfully they seem to be moving away and going with WMP and flash these days...

While I don't use realplayer, I do use rhapsody. I don't find it bad at all. People don't realize that rhapsody is the 2nd biggest non-itunes store behind amazon. It's bigger than napster and zune marketplace.

The bad taste that Real left in people's mouths years ago still abounds today. They should have mended their evil ways years ago, but didn't. Shouldn't the question be "why would anyone use use RealPlayer," rather than "does anyone actually use it anymore?"

Real Player says stop using Internet Explorer?

It's so hard to choose. Do I keep the best web browser for Windows or a crummy media player I haven't launched in years?

Now, let me think about it.....

If this is indeed a flaw within the ActiveX implementation for Internet Explorer then other ActiveX components could exhibit the same behaviour. If (as is more likely) it is a flaw within Real's crappy out of date plugin then perhaps they ought to fix it instead of whining about possible overflows in IE.

I've stopped installing RealPlayer years ago. I can't say I care about any of the alternatives that can play the streams either. If a site only offers Real, it's their loss, not mine, and they need to get with the program.

(Adequate said @ #13)
And for those who'd need to read RealPlayer files, there's always Real Alternative...

Real Alternative is a must have for those rare occasions you need to view RM content. I also recommend Quicktime Alternative by the same author.

I have to add my "who uses RealPlayer?" comment as well.

The only times I've seen RealPlayer is when it comes pre-installed on a computer.

What point is there in the software? Flash / WMV / QT is pretty much the standard for Internet video.

I actually *love* the fact that WMV use is dropping as well in favor of more Flash based videos.

I truly cannot think of one person that uses this thing anymore, nor have I seen links to any RP-based videos on the web.

It is on topic. The original, original source for this article is an blog post from the Internet Nazis at SANS, who have no clue that no one uses RealPlayer anymore and whose solution to everything is to switch to Firefox.

Oh look, a RealPlayer article and its obligatory tail of "who uses this anymore" posts, that's far more useful than commenting on the actual content of the article isn't it? Oafs.

I really can't understand this reflex behavior every time RP is mentioned. Yes, we get it, it's not widely used anymore, and you don't like it / never liked it. Is it really worth telling everyone so, yet again? I just don't see what anyone gains from that.

FWIW, I find RP quite useful on Linux (and Windows, when at work). I don't agree whatsoever that it's bloated, compare its resource usage with WMP10 FFS. The unnecessary UI components and the legendary (but much overhyped IMHO) adware content can be disabled in about a minute on first setup, and then you just have a nice small-form-factor media and streaming client that, in my experience, works quite reliably for as long as I need it.

It may not be very cutting-edge these days, but it still seems to do its job quite adequately. Interesting to note that when I tried going to YouTube's mobile site on my new Nokia's mobile browser the other day, the video didn't load in the included MiniFlashPlayer, but in RealPlayer! So I guess it's not quite out of the game yet, eh?

Anyway, on-topic for a moment... who on earth uses Internet Explorer these days? <ducks>

I think that kind of comment is relatively justified, if you consider it a sarcastic response to the report's suggestion that users stop using their browsers because of a flaw in another program.

(Ficman said @ #5)
Good Lord.... Who uses Realplayer anymore... If you haven't yet, stop using it...

Of course, the following is true as well....

"Good Lord.... Who uses Internet Explorer anymore... If you haven't yet, stop using it..."

(Davebo said @ #5.1)

Of course, the following is true as well....

"Good Lord.... Who uses Internet Explorer anymore... If you haven't yet, stop using it..."

can't say that when the majority of the market uses it I'd say over 85% of the world using it is a majority...

(neufuse said @ #5.2)

can't say that when the majority of the market uses it I'd say over 85% of the world using it is a majority...


I'd love to know where that % comes from, nobody I know allows it on any of the networks they manage nor do we allow it.

Source please?

Is there any alternative to RealPlayer? Even Real Alternative and VLC don't do the job sometimes... I've given up on the RealPlayer formats. On my machine, the browser plugins take even longer to load than Java (for that, I thank Sun).

As for RealPlayer itself, who in the world still uses it? I haven't seen it in my town for quite some time.

(rpgfan said @ #4)
Is there any alternative to RealPlayer? Even Real Alternative and VLC don't do the job sometimes... I've given up on the RealPlayer formats. On my machine, the browser plugins take even longer to load than Java (for that, I thank Sun).

As for RealPlayer itself, who in the world still uses it? I haven't seen it in my town for quite some time.

You can send an e-mail to the content provider and tell them you won't use it 'til it's in a better format, but it probably wouldn't help.

(guruparan said @ #2.1)

+1


+2. The only reason I've got it installed is because some people still use their formats online, and Real/Quicktime Alternative won't work online, so I've got Quicktime installed as well.

Speaking of formats, I was left puzzled earlier this week wondering why almost everyone uses .avi over .wmv. I converted some videos from .avi to .wmv using Any Video Converter, kept it at the same resolution and quality. In .avi, the files totaled 2.64GB, but in .wmv, I saved over 1GB! It was exactly the same as well, playback wise.

(MightyJordan said @ #2.2)

+2. The only reason I've got it installed is because some people still use their formats online, and Real/Quicktime Alternative won't work online, so I've got Quicktime installed as well.

Speaking of formats, I was left puzzled earlier this week wondering why almost everyone uses .avi over .wmv. I converted some videos from .avi to .wmv using Any Video Converter, kept it at the same resolution and quality. In .avi, the files totaled 2.64GB, but in .wmv, I saved over 1GB! It was exactly the same as well, playback wise.

Because Divx and xvid is a major format... which is cross platform... WMV is semi cross platform... mainly apple and windows... divx is supported by dvd players too generally