A software slipup in RealNetworks' music player means that Windows, Mac and Linux computers could be compromised by a fake movie file, a security company said Friday.
The problem means that fake movie files could be created that, when played by vulnerable Real software, would run a program instead. The flaw appears in RealPlayer 10 for Windows and Mac OS X, the RealOne Player for Windows and Mac OS X and the Real Helix Player for Linux.
"Anyone who has RealPlayer is affected, and there are many people with RealPlayer," said Marc Maiffret, chief hacking officer at software security company eEye Digital Security, the company that discovered the security issue.
RealNetworks could not immediately be reached for comment.
RealNetworks has issued patches for the flaw.
The flaw occurs in a component of Real's software that handles Real movie files with the .rm extension, according to eEye's advisory.
Similar to the recent flaw in Windows applications that handle the JPEG image format, this vulnerability affects a widespread piece of software and could be used to create a virus.
"It's similar to the JPEG flaw in the sense that just by viewing the file, or having the file 'force viewed' through a Web browser, your system can be compromised," Maiffret said. "I think both this JPEG vulnerability and the RealPlayer vulnerability are good examples of a type of threat that is becoming more prevalent: client-side vulnerabilities."
Rather than finding a security hole in the operating system and gaining direct access to a computer, attackers are now increasingly looking at exploiting widely used applications.
"Most security software...is not able to defend itself well against these client-based vulnerabilities, leaving companies with few alternatives other than patching," Maiffret said.
I'm completely surprised by the lack of comments on this article.
Where are the usual software bashers when a serious flaw is found in a product from a company other than Microsoft? And this affects Linux too! Can you believe it?! You'd think by some of the comments people make bashing MS and the software they create along with the encouragement to drop Windows and move to Linux that Linux didn't have any vulnerabilities at all. Of course, I find that most of the people making comments like that have no idea what theyre talking about to begin with.
If this had been a MS only issue the threads would have been flying in this forum.
... but I trashed Real Player some time ago. It's hard to complain about long gone software.
And as far as the company goes, while I do believe that it's staff is generally less than technically competent, apparently the company meets the same set of criteria people use to justify M$'s existance. Well, maybe the net assets category is somewhat lacking......
Google creates an animated doodle that features a boy, a girl, Google's search engine, and a jump rope. But might there be darker, more analytical, more troubling interpretations to this tale?
The Silicon Valley online payments startup grew by 1,000 percent last year and is hopeful it can repeat that level of growth this year. To do that, it's had to move away from its early friends-and-family roots and embrace small businesses.
Chamtech's spray-on antenna uses a nano material to provide a low-power boost to antenna range. The wireless-in-a-can product may some day bring an end to unsightly cell towers.
EnerG2 opens a plant to make an engineered carbon that will improve performance of energy storage devices and make storage for start-stop hybrid cars less expensive.
Where are the usual software bashers when a serious flaw is found in a product from a company other than Microsoft? And this affects Linux too! Can you believe it?! You'd think by some of the comments people make bashing MS and the software they create along with the encouragement to drop Windows and move to Linux that Linux didn't have any vulnerabilities at all. Of course, I find that most of the people making comments like that have no idea what theyre talking about to begin with.
If this had been a MS only issue the threads would have been flying in this forum.
about long gone software.
And as far as the company goes, while I do believe that it's staff
is generally less than technically competent, apparently the
company meets the same set of criteria people use to justify
M$'s existance. Well, maybe the net assets category is somewhat
lacking......
no they didn't my bad...