Slashdot Mirror
Three Vulnerabilities Discovered in Real Player
prostoalex writes "British Next-Generation Security Software discovered three vulnerabilities in popular Real Player. A malicious attacker can execute arbitrary code by offering corrupted RealAudio stream. Real Networks posted the instructions on dealing with security flaws."
"Your band's so bad that their voices hack real player"
What's the world coming too?
YAAAAAAaaaaaarrrrgh!!!!
"LOLOLOLO!!!!11 j00 h4v3 b33n HAC....buffering.....buffering....buffering...."
From the Real Player Knowledge Base:
To prevent maliciously formatted video streams from providing a backdoor into your system, type the video stream by hand and verify that it contains no malicious code.
Cyde Weys Musings - Scrutinizing the inscrutable
The specific [buffering] were:
Exploit 1: To operate remote [buffering] from the domain of the [buffering] opened by a [buffering] file or other file.
Exploit 2: To fashion [buffering] which allow an attacker to on a user's [buffering]
Exploit 3: To fashion [buffering] create Buffer Overrun errors.
"There is no teacher but the enemy."-Mazer Rackham
From the Real Player Knowledge Base:
To prevent maliciously formatted video streams from providing a backdoor into your system, type the video stream by hand and verify that it contains no malicious code.
Anybody out there who can type at 128 kbps?
I still haven't gotten past configuring my message center options in Real Player. Boxes keep popping up. I've bought the full version three times now. What's wrong?
All your bass are belong to us!
(sorry)
Then you must send 34 seconds of a certain portion of the movie 'Deliverance' over a period of 22 minutes.
These two things must be accomplished while repeatedly hitting 'alt-f4' on your keyboard, and screaming, "Damn you Real Player! Damn you to Hell!' like a woman.
Of course, if you reboot you'll have to start all over again, after a slight delay.
Um, a longer delay.
Ok, you get one shot at this, I guess. At least the exploit is consistent with their user interface.
RealPlayer is a program you use when you half to.
I wouldn't even use it if I third to.
[x] I'd uninstall Realplayer, but [insert choice pr0n site] still streams its content with it and I can't be without it.
Possible Solution: If we can get the pr0n industry to take an interest in OSS, then Linux on the desktop would excel!
cause one though or sure about real player is that its buffers are never full.
Buffering.... 86%
Spyware, adware, "helpful" browser adjuncts.
Oh, wait, you mean another malicious attacker!
-- MG
slip-up at a social cocktail party, since they're hardly invited
STDs transferred during sexual intercourses and foreplay with persons of opposite sex
overspending on deodorant
huge water bills due to frequent showers
complaints from Mom about yet another basement party
Its ironic that one of the vulnerabilities is a buffer overflow.
There are only 2 types of Real Player users:
1) New users who just finished downloading the software and don't hate Real Player yet
2) FUCKING STUPID PEOPLE
buffering.......buffering.......buffering......
Today's Dilbert is strangely appropriate...
Read
Fellowship 9/11
You kids are getting spoiled by your exploits delivered conveniently in a real media stream. Back in my days I had to get up in the morning, at ten o'clock at night, half an hour before I went to bed, eat a lump of cold poison, work twenty-nine hours a day down at the mine and dig out my exploits and pay the mine-owner for permission to come to work, and when we got home, our dad would kill us and dance about on our graves, singing Hallelujah!
Oh, ay. And you try and tell the young people of today that, and they won't believe you.
Granted, the software may be buggy, their "fix" is to upgrade. A market ploy comes to mind.