Slashdot Mirror
Three Vulnerabilities Discovered in Real Player
prostoalex writes "British Next-Generation Security Software discovered three vulnerabilities in popular Real Player. A malicious attacker can execute arbitrary code by offering corrupted RealAudio stream. Real Networks posted the instructions on dealing with security flaws."
that'll fix it.
How about Linux, are we safe? I didn't see any reference...
Cheers,
RoadkillBunny
"Your band's so bad that their voices hack real player"
When the company was called Progressive Networks, they put out some of the most revolutionairy software on the Internet... software that could make decent sounding realtime talk radio streams with just 14.4kbps of modem bandwidth to work with. When 28.8kbps modems came out, they came up with a codec good enough for most FM radio stations...
.com bites the dust.
But, oh how the mighty have fallen. The RealNetworks of today stopped advancing their audio protocols long ago, and have sense been lapped by the field of other audio standards. Now, RealNetworks is more of a content company, selling "-Pass" products that create monthly fees to access streams that used to be free.
So, I guess I'm not surprised that there's a "lazy programmer" style security flaw in their products today. They stoped being a tech innovator, and have slid over into the category of a content pusher. Oh well... another
I still hate RealPlyaer. Any sort of file format that requires me to install the company's software to use I will eternally hate, regardless of who it is. I hate Real, and I hate Quicktime. I'd ask that they both die a slow miserable death, but I honestly want them both out of the way so that more open standards will take their place faster.
/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i
"we cannot guarantee and do not warrant that the operation of any RealNetworks product will be error-free, uninterrupted or secure."
Thanks, I needed that.
I never install RealPlayer. Anyone who puts that much malware in their program obviously doesn't have their heart in it.
For the love of God, please learn to spell "ridiculous"!!!
What's the world coming too?
YAAAAAAaaaaaarrrrgh!!!!
"LOLOLOLO!!!!11 j00 h4v3 b33n HAC....buffering.....buffering....buffering...."
Does we know if "Real Alternative" player is compatible with these vulnerabilities?
From the Real Player Knowledge Base:
To prevent maliciously formatted video streams from providing a backdoor into your system, type the video stream by hand and verify that it contains no malicious code.
Cyde Weys Musings - Scrutinizing the inscrutable
Often these types of vulnerabilities only affect one platform (and usually Windows), but does anyone know which platforms are affected by this new exploit? Mac OS X and Linux too? Does it make any difference if I used apt-get to install the RealPlayer binary instead of the Real packaged one? I'm in the middle of sealing off RealPlatyer ports on all our organization's firewalls at the moment, but a lot of them are running OpenBSD and we're having trouble keeping them up long enough to edit the firewall config files.
Real Alternative in Media Player Classic. The version I use on XP has some flaws, but it is better than nothing, and I hope doesn't have the same flaws as the REAL Real Player?
Saskboy's blog is good. 9 out of 10 dentists agree.
The specific [buffering] were:
Exploit 1: To operate remote [buffering] from the domain of the [buffering] opened by a [buffering] file or other file.
Exploit 2: To fashion [buffering] which allow an attacker to on a user's [buffering]
Exploit 3: To fashion [buffering] create Buffer Overrun errors.
"There is no teacher but the enemy."-Mazer Rackham
So, where can I download a Windows binary of the Open Source Helix player?
Schwab
Editor, A1-AAA AmeriCaptions
I'm not a programmer, so I have a question for those of you who are.
Would these same sorts of vulner's apply to Real Alternative too, or does the active X wrapper prevent the hack?
-Ryan
AUWYHSTOT (Acronyms are Useless When You Have to Spell Them Out Too)
From the Real Player Knowledge Base:
To prevent maliciously formatted video streams from providing a backdoor into your system, type the video stream by hand and verify that it contains no malicious code.
Anybody out there who can type at 128 kbps?
I still haven't gotten past configuring my message center options in Real Player. Boxes keep popping up. I've bought the full version three times now. What's wrong?
Your band is so bad that playing it on Real Player spawns virii
The best planning can be done after the project completes.
here's an idea.
say you have just written a nice little piece of "value-adding" code, say you work at Real, say your boss likes it and would like for every Real customer to have it.
Both of you would know that a person like me keeps Real Player on my computer only for those "must have real" moments and want nothing further to do with Real.
Well, well, well, how can they get me to "upgrade" to their new "spyware" (tin foil here)? That's right - hire a 3rd party to "find" very, very nasty bugs...then claim to have THE SOLUTION!!!! Get the NEW version....with the crapware!!!
br.horyryaryyaryaryyy!!!
That was supposed to be first _post_, not port! sorry about that. too much BSD on the brain. can't wait till we upgrade those damn servers to Linux next week!
1. Uninstall realplayer
2. Get Mediaplayerclassic
All the good shits in DivX nowadays, the porn people are really up on the latest and greatest, most are already using DivX 5 standard.
"Sic Semper Tyrannosaurus Rex."
All your bass are belong to us!
(sorry)
Then you must send 34 seconds of a certain portion of the movie 'Deliverance' over a period of 22 minutes.
These two things must be accomplished while repeatedly hitting 'alt-f4' on your keyboard, and screaming, "Damn you Real Player! Damn you to Hell!' like a woman.
Of course, if you reboot you'll have to start all over again, after a slight delay.
Um, a longer delay.
Ok, you get one shot at this, I guess. At least the exploit is consistent with their user interface.
Seriously, when was the last time anyone really used realplayer? Its almost impossible to find the free version of their software on the website, so there market share dropped tremondously. Furthermore, their software is so bloated and resource hungry, that their software is all but useless. Admittadly, 5 years ago it was cool, but now there are several better alternatives, especially with the advent of winamp 5.
It appears from the press release on RealNetworks' site that the vulnerability does not affect the Mac OS X version.
Hm, once again, nothing to worry about.
Has anybody tried Real Alternative?
I would imagine that it is not affected... perhaps this is a good time to plug it. Get it from here. Just Media Player Classic is also available.
I'm sorry but there is simply nothing good about this piece of software. It's sucked since version one and sucks progressively more as time goes on. As a matter of fact Microsoft's wmv and wma kicks the shit out of it and that's saying something.
I installed "V10" today and unchecked EVERYTHING about internet connections, update checkers, shortcuts, file associations etc and the damn thing still did it anyway. I eventually copied it to my gentoo box and mplayer handled it fine besides not being able to queue or fast forward. God I HATE RM shit. Gaa!
I haven't posted in so long, my sig is out of date.
you just got another mod point. you be up to +5 Interesting by the time I'm done posting this. I bow before your leet trolling skills.
I didn't see any vulns mentioned for the linux Helix client, tho IIRC there's plenty of RP8 and G2 installs. I don't imagine that Helix would be any more vulnerable than RealOne if they have that much in common, and it'd still be restricted to my user and home dir (linux). Ideas?
C|N>K
RealNetworks: We won't, you see, patch the product. But we have the next best thing! All you need to do is not click on or load any malicious software!
Oh, wait...
I have discovered a truly marvelous
[x] I'd uninstall Realplayer, but [insert choice pr0n site] still streams its content with it and I can't be without it.
Possible Solution: If we can get the pr0n industry to take an interest in OSS, then Linux on the desktop would excel!
I didnt see anything about the free OS X version from a quick scan of the threads. BTW, the player on OS X is not nearly as bad as the Windows player. It doesnt hijack anything nor install spyware. It stays away until it's called upon. They still littler the desktop with little rm icons though - they should auto clean that shit when the file is done playing....
I hope we do plan to do what's right and throw the discovery team in jail.
we've got some real winners moderating tonight. this gets modded as flamebait while the debian troll gets a +5 Interesting (should've been modded Funny) score posting about how all his openbsd boxes are crashing. ah well, I haven't M2'd in a while so it's as much my fault as anyone else's.
For those new to Windows, here's a complete fix for the vulnerabilities and sneakiness of RealPlayer:
Start / Settings / Control Panel / Add or Remove Programs / RealOne / Remove
What's SSH have to do with Linux??? If you're talking something about OpenSSH and Linux being insecure (I assume RedHat of course), it's not the Linux folks that have made it... It's OpenSSH and OpenBSD, that have also "ported" it to Linux.
If you don't like Linux or SSH, go back to windows and use telnet.
Someone's bound to point this out, might as well be me.
There has been significant development on "alternative codec" to both Real and Quicktime. Google for "Real alternative" or "Quicktime alternative" to find the codecs. They can also be downloaded in a "bundle" of sorts from here : http://www.k-litecodecpack.com/
I've used the quicktime one with Media Player Classic and have been very happy with it.
I kind of despise Real player, and rarely find any good content that uses it, so I haven't actually wasted time downloading the replacement codec, but I'd be willing to bet it works fine.
FYI, you can get ssh programs for linux & unix from www.ssh.com as well.
They have some useful features that OpenSSH does not, like being able to use signed certificates instead of plain RSA or DSA keys. Signed certs make it much harder to do a man-in-the-middle attack.
cause one though or sure about real player is that its buffers are never full.
Buffering.... 86%
Spyware, adware, "helpful" browser adjuncts.
Oh, wait, you mean another malicious attacker!
-- MG
And so grrmungle. Because I used it makes it English you ugly grrmungle.
grr... Not true This is not a OS flaw issue. Sure, this flaw may not *happen* to make their mac os x build vulnerable, but that's only a coincidence when the flaw is in their source code (that causes a buf overflow).
Before you tout your OS as the man, you should know what it deserves credit for and what it doesn't. For the record. My machine is a 17" G4 that I swear by, and I'd fight to the death before using OS as my daily driver.
G-Force music visualization
Its ironic that one of the vulnerabilities is a buffer overflow.
Virii are small and efficent. Realplayer is not.
All misspellings and grammatical errors in the above post are intentional and part of my artistic expression.
I used it with mixed success. At first, it seemed great. Then something happened and files wouldn't play. When I uninstalled it, RealPlayer wouldn't work -or- uninstall correctly. Finally I found the command-line method of uninstalling RealPlayer (which cleaned up the registry, I think).
After that, I reinstalled RealPlayer and gave up. Although it was cool playing Real files in non-Real players for a while.
I might try RealAlternative again some time.
There are only 2 types of Real Player users:
1) New users who just finished downloading the software and don't hate Real Player yet
2) FUCKING STUPID PEOPLE
A malicious attacker can execute arbitrary code by offering corrupted RealAudio stream. You mean the Real executives?
buffering.......buffering.......buffering......
MPC has just repackaged the Real codecs, so they likely have the same flaws.
libgsm1
This compresses talk stream down to 1.6kB/s (or 13kbits). From their readme file:
Isn't this much better than some close-source codec? Real probably uses GSM for that 14kbps codec anyway!!
BTW, this codec is excellent for text and even somewhat good for music (though like a bad AM radio in the music area :)
:)
Apple now supports GSM in their player
RealNetworks, Inc. has recently been made aware of security vulnerabilities that could potentially allow an attacker to run arbitrary code on a user's machine.
The specific exploits were:
* Exploit 1: To operate remote Javascript from the domain of the URL opened by a SMIL file or other file.
* Exploit 2: To fashion RMP files which allow an attacker to download and execute arbitrary code on a user's machine.
* Exploit 3: To fashion media files to create "Buffer Overrun" errors.
While we have not received reports of anyone actually being attacked with this exploit, all security vulnerabilities are taken very seriously by RealNetworks. RealNetworks has found and fixed the problem.
Affected Software:
"Exploit 1" affects RealOne Player, RealOne Player v2 for Windows only (all languages), RealPlayer 10 Beta (English only) and RealOne Enterprise Desktop or RealPlayer Enterprise (all versions, standalone and as configured by the RealOne Desktop Manager or RealPlayer Enterprise Manager).
"Exploit 2" affects RealOne Player, RealOne Player v2 (all language versions, all platforms), and RealOne Enterprise Desktop or RealPlayer Enterprise (all versions, standalone and as configured by the RealOne Desktop Manager or RealPlayer Enterprise Manager).
"Exploit 3" affects RealOne Player and RealPlayer 8 (all language versions).
Workaround:
Dont run our shit.
... Microsoft Monopoly.
.WMV that looks like "the default choice" for many.
The thing is that Real does not have a source of income. Thus, they need to squeeze pennies out of every possible opportunities often not playing nicely (I mean charging for crap, ads and SPAM).
At the same time, every format owner is trying to make his one a default. Not supporting Real means that their "commercial" format will die causing all contents providers switch to
It is the repetition of the browser wars.
BTW, I avoid most of their crap by using older version (revision 6.0.6) of the RealPlayer.
Tigers respect lions, elephants and hippos. Maggots respect no one. (C) S. Dovlatov
Hm, I originally from reading their press release, I didn't quite get the picture that this also applied to the OS X version. Now that I re-read the press release, and the other post here, I am still equally confused.
You kids are getting spoiled by your exploits delivered conveniently in a real media stream. Back in my days I had to get up in the morning, at ten o'clock at night, half an hour before I went to bed, eat a lump of cold poison, work twenty-nine hours a day down at the mine and dig out my exploits and pay the mine-owner for permission to come to work, and when we got home, our dad would kill us and dance about on our graves, singing Hallelujah!
Oh, ay. And you try and tell the young people of today that, and they won't believe you.
It's so surreal, really.
heh heh
Lameness filter encountered. Post aborted!
Reason: Your comment looks too much like ascii art.
I think you will have the same vulnerabilities. Media Player Classic simply uses the codecs from Real, so any flaws in the codecs will still be there despite using Media Player Classic. Real Alternative seems interesting though since it lets you install the codecs without having to actually install one of the players. I don't use Windows anymore, but I could use that to get the RealOne crap off my the computers of my family members.
Real Networks have decided to follow Microsoft's lead, and instead of fixing the security flaw (see Microsoft and passwords in http headers) Real Networks have have removed the offending feature.
The next version of Real Player will have the ability of plaing *.rma and *.rmv files removed to protect end users from the evil internet.
All users of Real Player are urged to update their player. An email virus^H^H^H^H^H^H will be sent to every registered user containing a patch to be executed as the Administrator user.
From Boris Badenoff
Real Networks Russia
it is only after a long journey that you know the strength of the horse.
Upgrade my old, yet "safe" version of Realplayer, or risk having my box get owned...
Well, i do backup regularly....
Real's approach has always been to have their latest & "greatest" software running on your PC. ("greatest" software is less well tested).
So I run RealPlayer8 Basic when I need to. Their fix is to have me replace it with RealPlayer10 Gold? I don't wanna.
I also don't like having to upgrade to a newer set of local softwares simply because the "file format" has changed. There aren't that many advances in formats/compression over time, and it seems to me that: new formats are released more frequently than necessary, thus "requiring upgrades" to new readers of said formats.
(A) Patch the buggy apps you still support; don't make us install new (less well tested) software so often;
(B) Don't tie the desire to distribute your latest code to [often] unnecessary media format changes.
"I Sam thee to Dayton! (It's worse than Cleveland.)"
I signed up for the real player plus free trial - hoping that the popups and other buy-this-too spamming tactics would end if I forked over a monthly fee.
1) The pop-ups didn't stop. In fact, they increased.
2) Trying to cancel the free trial involves not only going to a web site to cancel, but after you do that you have to call and cancel.
3) To add insult to injury, it takes at least 60 minutes on the phone to cancel your free trial.
4) There is no option on the number they have you dial to cancel your account.
5) If you do manage to successfully navigate their phone menu system, the guy you end up getting on the phone doesn't cancel your account until you listen to him hard sell you and harrass you about cancelling.
I actually would like to have realplayer installed on my machine to take advantage of the occasional cnn or espn clip that is only available on real player, but the fact that they send you endless amounts of spam on top of putting popups all over your desktop to buy their products really makes me avoid this application on principal. I know that there are ways to configure things to reduce these problems, but quite frankly, you can't stop them completely without going through a great amount of effort.
Real networks have in the passed on customer details (email address at least) to third parties in the past. I've seen them caught out when a form of email address "real@mydomain.com" was used - where this will reach the mail administrator at "mydomain.com". You guessed it, after using the address on real networks site, suddenly spam starts being sent, addressed to real@mydomain.com
Someone could try this trick again if you have their own mailserver - see if they're still at it.
-- *~()____) This message will self-destruct in 5 seconds...
Do we know seems to be better... :-)
Pssst, i don't use Real .. stuf. Si should you!
Grtz,
M
Or, try booting from a Mandrake install CD.
is Real Alternative running on Mac OS X ?
didn't find it....
thanks
This is not informative, this is misinformation. Real alternative and Quicktime alternative don't give you alternative codecs but alternative players that use the original codecs.
Real Alternative is a reverse-engineered program
No, its simply an ActiveX wrapper for the original Real dll's, nothing is reverse engineered
then it starts to be likely they stole the code
from where ?
even Real's pseudo-open-source helixcommunity.net the non important gui crap is open but the codecs (the important bit) are still very much closed source and binary format only, so no stealing code as there is none to steal
so yes Real alternative contains this flaw, but if you want to patch it by installing Real's new player then go right ahead, iam sure they will _love_ for you to install their new "secure" player (along with all its naggging/spyware infestation)
I only play mpegs with mpeg_play, where it's also possible to save the data and review later. RealPlayer can suck my bawls.
Acroreader too. I only use xpdf.
Installing spyware/trojanware/backdoorware (software with vunerabilities for which the company pretends they are unaware of, but some people know them very well), on many systems, is worth much more than selling a couple of packages these days.
Granted, the software may be buggy, their "fix" is to upgrade. A market ploy comes to mind.
Can be found here:e .txt
http://www.nextgenss.com/advisories/realon
If you don't like Linux or SSH, go back to windows and use telnet.
I was joking. You really are very stupid. As are the idiots who moderated my post as "troll".
Tubal-Cain smokes the white owl.
like jay and silent bob said...
fuck real networks, fuck them up their stupid asses!
So that I can listen to the BBC's massive audio archives. Some of it is now available in Windows Media format but you still can't access most of the site without using Real Player. Real Player may be (is) crap but having to miss out on the BBC's listen again pages would be even more crap.
That's very perceptive of you Mr Stapleton and rather unexpected in a G Major
They need a security hole that fixes the ..." buffering... buffering... buffering..."
e
Build Your Own PVR/HTPC news, reviews, &
Hey question for you guys, I've seen a lot of negative comments about Real, most of which are understandable as I myself until recently refused to install their bloated software.
Anyone familiar with the Helix project (www.helixcommunity.org)?
From the website:
The Helix community is a collaborative effort among Real, independent developers, and leading companies to extend the Helix DNA(TM) platform, the first open multi-format platform for digital media creation, delivery and playback. The Helix DNA platform is comprised of the following:
* Helix DNA Client
* Helix DNA Producer
* Helix DNA Server
* RealAudio and RealVideo codecs
I'm not too familiar with it but is it a step in the right direction for a company that once used to be on the cutting edge of digital media and now is trying to get back in the game? Or is it just another one of their corporate blood sucking tacticts? What are your thoughts?
[alk]
ror!
uuuuuunnnnnggggghhhhhhhhhh!!!!!
I hate Real, and I hate Quicktime. [ . . . ] I honestly want them both out of the way so that more open standards will take their place faster.
Quicktime is a wrapper, not a file format. As such, it supports open standards.
blog
Download "Real Alternative"..
Get Quicktime Alternative while you're at it.
Since the only answer to fixing the version 8 bug (the last free version, which I still run on my machines) is to upgrade to the pay for it versions.
Oh, and I can't use Real at work anyway, since it is incompatible with the firewall here.
The only show I really listen to offered Real, WMP, and they were even offering Winamp for a while. Now it is WMP and that's it. Haven't actually used Real for some time. Looks like it is about time to dump their donkey.
Real Networks posted the instructions on dealing with security flaws.
A better way to deal with these security flaws (and the bloated piece of crap that is RealPlayer) is to uninstall RealPlayer and download Real Alternative.
Watch out, with a hole like that someone could install any malicous code. Trojans, spam machines, even Realplay...what? Oh...nevermind.
You can't take the sky from me...
Am I the only one who sees the irony of Paula Abdul critiquing other people's singing?
You could use alternative real player in combination with media player classic http://www.majorgeeks.com/download4094.html ...and free yourself from two bloatware packages in one fell swoop.
We love the beeb!
I'm aware of "pain in the ass" RealPlayer and RealPlayer "adware for your spyware only", but I haven't seen the "popular" one yet.
And I haven't tired of putting "things" in "quotes", either.
when major broadcasters are dumping real's products due to their "betcha can't find the free version" antics, maybe real would wisen up and actually make good on their "free" players.
not that i care - real alternative and media player classic take care of my windows-based media viewing just fine, minus all the spyware and other crap.
Realplayer is popular?! Stop the presses! I think a better word for Realplayer (that doesn't contain only four letters) is prolific. Popular implies that people actually like having to use it.
--Obyron
The only fact that allowed RealPlayer to remain on my system was that you didn't need to upgrade to the horrible, slow, ad-infested RealOne player. I've had no problem playing any "real" content with RealPlayer 8. It's not the best player, but compared to RealOne it is lean and mean.
For people using RP8, the "fix" is to upgrade to the latest RealOne player (V2).
Given those choices, I think any remaining RealPlayer users will choose to uninstall the software.
I follow this because they are assholes, but it works just as well for avoiding their bugs too.
Try mplayer classic.
I've got RP on my Nokia 3650...what about that?
Again, the article is weak and has few details.
And real wont say how many are affected (security through obscurity?)
jerkwad script kiddies...
You know, way back when, I used to like RealPlayer. It was my source for 24/7 music videos, news, and other good stuff. Unfortunately, the last good RealPlayer was RealPlayer G2.
The advent of RealPlayer 8 ushered in the era of "pay or get lost" attitude that makes me despise Real today. Granted, it wasn't too bad; it didn't try to take over every part of your computer so that all your Word files would now be handled by the RealOne Player. But it was still annoying to have to shut off the "StartCenter" with every install and be told, "Your computer will work better with our resource hog running! Are you sure?"
RealOne is even worse. Not only does it try to associate itself with every possible file format on your system (even after you restore your associations to the right ones), it takes away features that used to be free (you're telling me I have to pay to use a compact player? I don't think so).
I think I'll stick with RealPlayer 8 and take the risk.
I pity you.
g ]
fap
fap
fap
[buffering]
fap
fap
[bufferin
fap
(someone had to say it..)
I, too, use Media Player Classic on my winboxen.
But because MPC merely uses the Real codecs, what if the vulnerability is in the DLL for the codec, not the player?
MPC could be as vulnerable as RP8 or RealOne, at least until we figure out exactly is patched in the "update" Real is offering as a workaround. Did they update the PLAYER, or did they update the DLLs that render the .rm files?
"Millions of Vulnerabilities Waiting to be Exploited!"
:)
They're called users
I stopped using RealPlayer at version 7, I refuse to upgrade to any higher version. I used to use Real for virtually all my media, but now I only use RP7 for occasionally playing the RealAudio files that I kept.
I'm not sure how many mod points you got because I have all troll modified comments set at +5, but let me say this, I put you on my "friends" list even though you already were a friend of a friend. Thank you for having and sharing an incredible sense of humor.
heh heh heh
Don't write me off as completely pro-Microsoft though - I'm still running WMP 6.4. As long as the WM9 and earlier codecs work for 6.4 and later, why upgrade?
Use Evolution instead of Outlook? Bewa
Seems like people have a lot to say about the quality of Real Player. My company ia about to purchase their Helix server. Bad move?
- rabs
You can use an old version of RealPlayer downloaded from http://www.oldversion.com that does not mess around with your PC.
Realplayer 8 is the last version of RealPlayer released before RealPlayer One which is the first version to use devious tricks to hide the checked no-spam/adware/malware checkboxes. Although RealPlayer 8 also has some opt-out ad thingies, at least in RealPlayer 8, they are easy to find and disabling them is straightforward. The only annoying thing about my version of Reallayer 8 is that occasionally, it asks me to upgrade to RealPlayer One, but this is easy to ignore.
As you can see from the front-page of oldversion.com, RealPlayer 8 is one of the most popular downloads on that site.
Thanks for the link I'll give it a try.
That's very perceptive of you Mr Stapleton and rather unexpected in a G Major