September 27, 2005 10:53 AM PDT

RealPlayer, Helix users at risk of attack

Popular media players RealPlayer and Helix Player are at risk of a security vulnerability that could let malicious attackers launch remote attacks on a user's system, security experts say.

A flaw has been discovered in RealNetworks' RealPlayer version 10.0.5.756 Gold and Helix Player 1.0.5.757 Gold running on Linux or Unix operating systems, according to a report released Tuesday by the French Security Incident Response Team, or FrSIRT.

Attack code that takes advantage of the flaw, a so-called exploit, has been posted on the Internet, increasing the security risk to users.

The RealNetworks products are vulnerable because of a format string error that occurs when a malformed .rp or .rt file is clicked and players are launched. Malicious attackers can take advantage of the error to take remote control of users' computer systems.

Bug researcher Contex discovered the flaws and notified RealNetworks about the vulnerabilities, but the company has yet to issue a security update, said Thomas Kristensen, chief technology officer for Secunia, a security firm that rates the vulnerability as "highly critical."

Kristensen, pointing to an advisory issued by Contex on the Open Security Group site, noted that the bug researcher was forced to prematurely publish the exploit code.

"Real has been duly informed about the issue and (they) are fixing (it). Sadly, though, it seems someone is trying to pinch my research. As such, I have been forced to release this advisory sooner than hoped," according to a Contex posting. "Until Real gets a new release out, do not play untrusted media with RealPlayer or Helix Player."

Kristensen noted the reasoning behind publishing the exploit code before a patch has been developed.

"By publishing all the details about the vulnerability, it helps people understand they have to be careful when following the links to the media files affected by these vulnerabilities," Kristensen said.

Representatives from RealNetworks were not immediately available for comment.

RealNetworks has issued several security patches for its media players this past year. The latest was in June, when it released fixes for four vulnerabilities in its popular RealPlayer media player.

10 comments

Join the conversation!
Add your comment (Log in or register)
Why worry?
use Xmms instead!
Posted by folsco (55 comments )
Reply Link Flag
XMMS, Xine & Mplayer rule!
Who uses Helix Player anyway? It's clunky, the interface *********** and it takes forever to load...

Use XMMS, Xine or Mplayer instead...
Posted by tocam27 (16 comments )
Link Flag
Why worry?
use Xmms instead!
Posted by folsco (55 comments )
Reply Link Flag
XMMS, Xine & Mplayer rule!
Who uses Helix Player anyway? It's clunky, the interface *********** and it takes forever to load...

Use XMMS, Xine or Mplayer instead...
Posted by tocam27 (16 comments )
Link Flag
Is anyone surprised?
RealNetworks has a long history of writing sloppy code with lots of security bugs, illegally collecting personal information, and abusing their customers in general. Oh, and should I mention that they take over mime-types, add shortcuts everywhere on your system, and install extremely annoying taskbar utilities and third party software? You can't blame their downfall on Microsoft or the Windows Media Player, it's all pretty much self-inflicted wounds.
Posted by DavidWorkman (14 comments )
Reply Link Flag
I'm with you
Ever since I last installed RealPlayer (seven I think) and I found it was easier to format my machine than to manually remove the evil thing I vowed to never install it again. They deserve to fade away.
Posted by Andrew J Glina (1673 comments )
Link Flag
Is anyone surprised?
RealNetworks has a long history of writing sloppy code with lots of security bugs, illegally collecting personal information, and abusing their customers in general. Oh, and should I mention that they take over mime-types, add shortcuts everywhere on your system, and install extremely annoying taskbar utilities and third party software? You can't blame their downfall on Microsoft or the Windows Media Player, it's all pretty much self-inflicted wounds.
Posted by DavidWorkman (14 comments )
Reply Link Flag
I'm with you
Ever since I last installed RealPlayer (seven I think) and I found it was easier to format my machine than to manually remove the evil thing I vowed to never install it again. They deserve to fade away.
Posted by Andrew J Glina (1673 comments )
Link Flag
Mplayer
Just use mplayer with realplayer codecs and you should be better off
Posted by (92 comments )
Reply Link Flag
Mplayer
Just use mplayer with realplayer codecs and you should be better off
Posted by (92 comments )
Reply Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

Inside CNET News

1-2 of 12

Scroll Left Scroll Right
Click Here

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.

Markets

Market news, charts, SEC filings, and more

Related quotes

Dow Jones Industrials (0.57%) 72.81 12,874.04
S&P 500 (0.68%) 9.13 1,351.77
NASDAQ (0.95%) 27.51 2,931.39
CNET TECH (0.84%) 17.13 2,049.14
  Symbol Lookup