If you use the RealPlayer on Internet Explorer, watch out. Researcher Elazar Broad has posted to the Full Disclosure mailing list a so-called heap overflow vulnerability that makes it possible for an attacker to modify heap blocks after they are freed and overwrite certain registers. This could allow code execution on a compromised machine. The vulnerability affects all versions of RealPlayer running under Internet Explorer.
Exploit code for this flaw has not yet been made public.
Without a patch from RealPlayer, security experts recommend disabling the killbit for the following ActiveX ClassIDs:
- 2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93
- CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA
To avoid the loss of functionality, security experts recommend using RealPlayer in a browser that doesn't support ActiveX, such as Mozilla Firefox (for Windows and Mac).
On Tuesday, exploits for the Yahoo apps were reported circulating. There is currently no patch from the individual vendors, so the only workaround is to disable the several specific, vulnerable ActiveX controls. (ActiveX controls were developed by Microsoft for use with Internet Explorer and other browsers.)
The SANS tool, available here, eliminates the risks associated with editing the Windows system registry file. A command line version is available here.
The kill-bit tool first checks your system to see if any of the vulnerable CLSIDs exist. If so, the tool saves a copy of any values currently set, then updates the display to show that the CLSID--the unique sequence assigned to each ActiveX component that specifies which control you are using--exists. It also shows whether the kill-bit flag is set. To set the kill-bit, just check the box beside any of the affected ActiveX controls then click on the "Set" button. Unchecking any of the boxes will either reset the "Compatibility Flags" to their saved value or remove the CLSID entirely (if you didn't have the control installed in the first place).
SANS suggests setting the kill-bits for all of the affected ActiveX controls, and, even if you don't currently have one or more of these CLSIDs installed on your machine, go ahead set the kill-bit for controls that might be added to your system in the future.
- prev
- 1
- next
