Beware of RealPlayer ActiveX flaw - Security Bytes
Home > IT Blogs > Security Bytes > Beware of RealPlayer ActiveX flaw
« Cisco follows the patch path forged by Microsoft, Oracle
Can Source Boston save us from boring security conferences? »
» VIEW ALL POSTS Mar 11 2008   9:23AM GMT

Beware of RealPlayer ActiveX flaw



Posted by: Bill Brenner
Network Security, Application Security, Information Security Threats, Security Management

Danish vulnerability clearinghouse Secunia is warning of a newly discovered security hole in the massively used RealPlayer application. The “highly critical” flaw, disclosed by researcher Elazar Broad, is unpatched at this point.

“The vulnerability is caused due to an error within the RealPlayer ActiveX Control (rmoc3260.dll) when handling the ‘Console’ property,” Secunia said in its SA29315 advisory. “This can be exploited to cause a memory corruption and execute arbitrary code when a user e.g. is tricked into visiting a malicious website.”

Secunia confirmed the flaw in RealPlayer version 11.0.1 (build 6.0.14.794) including rmoc3260.dll version 6.0.10.45. Other versions may also be affected, the firm warned.

Until a patch is released, users are advised to set the kill-bit for the affected ActiveX control.

AddThis Social Bookmark Button     Comment     RSS Feed     Email a friend

Comment on this Post


You must be logged-in to post a comment. Log-in/Register

Ezio Tricarico  |   Mar 12 2008   4:40PM GMT

I know about this problem with Real Player and I’ve already unistalled. I think that Real Player must to recall this products.


 
Visit Information Security Home |   Information Security News  |  Information Security White Papers  |  Information Security Videos  |  Information Security Resources