Slashdot Mirror
RealPlayer Zero-Day Flaw Under Attack
openOption writes "ZDNet is reporting that hackers are actively exploiting a zero-day hole in RealNetworks' RealPlayer media player, a software program installed on tens of millions of Windows computers worldwide. The in-the-wild attacks targets a previously unknown and unpatched ActiveX vulnerability in the way RealPlayer interacts with Microsoft's Internet Explorer browser. The flaw is causing drive-by malware downloads when an IE user simply browsers to a maliciously rigged Web page."
Used by no one... until now.
Greased up Yoda doll
Puckered anus
GO LINUX!
a software program
I like software programs. They run well on my computer PC and look nice on my display monitor. My computer PC works well, all the way from the electric power cable to the Ethernet network card, the hard disk hard drive, and my wireless keyboard keyboard and mouse mouse.
(What are synonyms for keyboard and mouse?)
God, I'm so glad I bought a computer with Windows XPN, which thanks to the wisdom of the European Union and RealNetworks' claims of unfair competition against their cuasi-malware player, does not include Windows Media Player! Yes, instead the OEM installed... oh, wait. They installed RealPlayer. Holy sh #$!@&*^} NO CARRIER
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
I don't want to be a troll, but people who install Real Player are asking for trouble.
Wow, I just had a scary thought I managed to block just in time before passing out: Real Player. On Vista.
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
The vulnerability doesn't affect IE in protected (sandboxed, default) mode on Vista, of course.
It's time to realise that Abble's products are the biggest abomination these days. Just say NO to the dumb iAbble way!!
...that the viruses using this attack were still easier to uninstall than RealPlayer itself.
Before you mod me funny, think, perhaps I was insightfully funny?
And what about Netscape plugins? This is not "download ActiveX controls on demand" which was chastised and basically isn't around anymore. This is the fact that some apps on your machine say "hey, I know how to handle some data on the net, just load this dynamic library of mine and hand it the data, and I'll render it neatly in the browser".
I had no idea people still use RealPlayer.
Whenever Zonk browsers to Slashdot to post a story, lots of spelling and grammar errors attacks us. Maybe he should install a software program to assist his editing.
All to true! A while back [adult swim] used to require activex to watch watch their videos on line. They kicked that to the curb since they realized that their demographic is the same demographic that is most likely to not use IE/ activex! They got the picture so should every one else!
Real has posted a video press release on this. I would like to tell you more, but it's still buffering. Maybe they should use Media Player for their press releases.
Gamingmuseum.com: Give your 3D accelerator a rest.
It's going to take a while for the virus to stop buffering....
http://www.free-codecs.com/download/Real_Alternative.htm
Now I just have to worry about unpatched holes in Windows Media Player!
Truthfully, I already have one bloated Media Player that is part of the OS on my machine, why would I want to install another?
BTW:
http://www.free-codecs.com/download/QuickTime_Alternative.htm
To take care of that OTHER bloated media player
Real networks finally figured who their 3 users are.
New marketing name -> RealTrojans (or viruses/worms, whatever). Sales are UP!
Nobody uses Vista because Vista's not compatible with Windows.
It's long been an annoyance to me that RealPlayer is installed by default on my Palm Tungsten E2, and there's no way to remove it without risk. It squats like a toad in my small pool of on-board RAM, taking up space I bought and paid for. On my PC, of course, it's just a smelly, fading memory, replaced ages ago by less toxic alternatives.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
You have been infected by a RealPlayer virus! Muahahah! In 5 seconds, your hard drive will be form ...buffering... ...buffering... ...buffering...
All 5 people who still have Real Player installed are in for a world of hurt...
We have four boxes with which to defend our freedom: the soap box, the ballot box, the jury box, and the cartridge box.
The malware that gets installed is, itself, Real Player.
Affected computers are stuck in a feedback loop where Real Player installs itself over and over again.
The space-time continuum is breaking down as we speak.
This vulnerability has nothing to do with ActiveX. ActiveX is just one method of hosting a plugin. Any method of hosting a plugin would be exactly as vulnerable. Anytime a browser accepts data from an outside source and passes it onto a library to handle that is a possible point of attack. There have been plenty of vulnerabilities found in non-ActiveX plugins for Internet Explorer and other browsers. There have been vulnerabilities found in the very libraries used by the browsers to display common content like images.
This is why the Vista approach is the correct approach: sandbox the browser. The process should be locked down so tight that when a vulnerability is inevitably discovered that the damage it can cause is mitigated. Every OS and every browser needs to incorporate these mechanisms by default.
The flaw is causing drive-by malware downloads when an IE user simply browsers to a maliciously rigged Web page.
I like the use of the word browser as a verb.
Also, drive-by malware downloads? This hood is no longer safe, yo!
Small though it is, the human brain can be quite effective when used properly.
Please, no more stupid verbs-nee-nouns.
"Blog" should have been smothered in the crib, let's not loose another monster.
Potato chips are a by-yourself food.
I remember first reading about activeX security vulnerabilities in one of the O'Reilly nutshell books about website design. The book also covered controversial topics such as the use of the and tags in HTML.
"Be grateful for what you have. You may never know when you may lose it."
overflow exploit, right?
Last time I saw real player was when I installed google pack on a windows machine years ago. I love picasa and google earth, and at the time a few of the other packages seemed like nice things to get all in 1 install. Real player was the deal killer- I never could figure out what good it was. It seems like it spent more of my time and CPU cycles trying to sell me on an upgrade than doing anything useful. What was/is google thinking on that one?
You seem to be inexplicably tense. Perhaps you should relax for a while and watch a television program.
Or go to the theater, and watch a play. If you have any trouble understanding it, you might find more in the program they give you. Hold on to it, they're collectible.
Whatever you do, though, don't rely on alcohol to relieve your anxiety. If you become dependant on it, you may need a twelve-step program to get yourself back on track.
The US free market: two halves of a government-granted duopoly are free to set the market price.
With ActiveX anyone can make something automatically execute.
With Firefox's plugin search there is a predefined list.
I think they meant to write "browses". Could have been a typo (the E and R are right next to each other), could have been a brain fart linked to muscle memory, but I really doubt someone's trying to introduce "browsers" as a verb.
Sony ha
Next up: Spam with attached Realmedia files that redirect to "stock sharing sites."
I'm waiting for a "-1 somepeoplejustshouldn'tgetmodprivileges" meta-moderation.
[Cancel] or [Allow] ?
I remember 'registering' Real Player back in the 90's so they sent me a CD-ROM with the 'paid for' version that had a 'record' button (for those really, really rare instances where a server allowed you to record the stream.)
Is Real Player still around???
Microsoft says legacy (serial/parallel) ports are bad. They don't obfuscate the hardware enough.
... and people still use Real anything...
Wow.
After that wretched "G2 Phone Home" crap and the whole "tell me who your are so I can spam the hell out of you unless you use a fake email address like 'realsucks@pissoff.com'" crap, I'm really suprised ANYONE uses the stuff. I haven't come across a single site in the last few years that uses Real to stream, and all of my musician buddies stopped encoding in Real format back in 2001 or so.
File this exploit under "does anyone really care?". It's like finding a zero-day exploit for Windows 3.11 or MS Bob.
Fifty watts per channel, baby cakes.
Just bloody great. My company insists upon loading RetardPlayer in our workstation images. This will mean another high-priority patch. Patching is always painful- either the sudden unannounced Gift of Reboot, or the One-Hour-of-Death-Clock, that stays on top of everything. All for near-abandonware that nobody uses. Ah, if only we ran Linux.....
In Windows you can define a list of "Administrator Approved Controls" and IE won't load any others. But it is a pain in the arse to configure and I'm the only person I know who's ever bothered. But I'm not vulnerable to this realplayer bug :)
I still use the real player. Really the only reason I do is becuase the 100+ downloaded south park episodes I have from southparkx.net are encoded as .rm files and are better quality (for a 36mb) than anything else. Honestly though, people rip on Real but I think itunes & quicktime (bundled together mind you at 50mb+) is a much inferior product than Real. Apple and Adobe are two of the worst bundling companies out there.
"During My Service In The United States Congress, I Took The Initiative In Creating The Internet." -Al Gore
drive-by malware downloads? good thing I got a MAC
I disabled that on my WinXP a looooooonnnnnnnngggg time ago.
-- Tigger warning: This post may contain tiggers! --
Would you like to permit this song to be played?
How about this song?
How about this one?
(repeat 50 times)
(user unchecks security check)
-- Tigger warning: This post may contain tiggers! --
The evil Realplayer is still required for some MIT open courseware. They should convert those files ASAP.
Sorry buy this post is buffering...
If you disable ActiveX in Internet Explorer, you will not be affected right?
Real released a security patch:
http://service.real.com/realplayer/security/191007_player/en/
The flaw is causing drive-by malware downloads when an IE user simply browsers to a maliciously rigged Web page
Of course this flaw only affects badly managed systems where the user is browsing the Internet while logged on as an Adminstrator.
Microsoft is trying to discourage this but the users are too stupid to realize what they are doing wrong, and keep adding themselves to the Administrators group and keep trying to get rid of "annoying" popups that tell them they need to supply their password before the system will install software.
http://tech.blorge.com/Structure:%20/2007/10/20/realnetworks-releases-realplayer-fix-for-zero-day-activex-flaw/
Seen in the firehose.
I don't think you understand. Playing media files in realplayer would not require elevation, since playing a song doesn't need root privileges. Playing media files in internet explorer would not require elevation either, since though IE is sandboxed, playing media files wouldn't require IE to write to anything other than the 'temproary internet files' directory. But if a webpage tries to install malware, that would require writing to a directory other than temporary internet files (so needs user privileges), so you *would* need to elevate; hence the GP's post.
What's purple and commutes? An Abelian grape.
ActiveX is the worst thing happened to MS, so many bugs, so many mistakes, and yet, it allowed by default, and if not, a site can pop up a message to allow it. Simple users click yes immediately when they see a pop-up, no matter what its content.
If you'll do a test and pop-up a windows-look-alike Pop UP which says : A memory corruption has occurred in 0xdeadbeaf which its dump said "you're a dumbass if you click-yes" and crushed Explorer.exe
Yes | NO
95% of the users will click yes, without even reading it, to be honest, that's the reason RealPlayer was even installed at their computers for the first place.
Read and Comment at my BLOG
!!!
My employer bought a company whose site had a ton of Real videos (I lead the internet services department). We just got through converting them all to streaming flash a week ago. It took a little work finding a tool that could do the job well. I feel better, the users win, it's all good. I just couldn't sleep at night knowing that I had a website out there that instructed good people to install the Real player.
You are not alone....
I encoded some of my footage to Real in 2001 or so. I stopped because people complained that they couldnt get the free player by following the link. I tried it and it was so hard to find the free player that I gave up encoding in Real. But my old stuff is still there in Real. I also got really turned off when Real was so hard to remove- and its spyware actions. Just this week I had to go into the registry to keep "realsched.exe" from booting and obnoxiously interrupting other processes to spam about updates. Updates, mind you, that you cannot refuse to search for. The realsched.exe is installed to boot everytime you play the player. Very, very obnoxious software- particularly for an alternative to Microsoft.
Nowadays we got YouTube.... They can pay the bandwidth. LOL.
Could you please name the tool or provide a link for those of us still streaming Real?
The last time I was forced to install the RealPlayer just to watch a piece on a website I was subjugated into a series of humiliating requests: screen after screen the installation process was going to possess all my media, substitute all the other legit players and link all the way possible into some shitty music download service.
As soon as I recorded the piece in another DRM free format I disinstalled that stinky crap and run several scan for spyware because ultimately reaplayer is more a posses-my-pc-experience than a player.
Conclusion: Those people running Realplayer showed they like to be abused by the same act of agreeing to the installation process. They thus deserve to be exploited by hackers. Anyway I guess those same people have been allready running bonzi buddy all this time.
Buggering... Buggering... Buggering...
Windows + Internet Explorer + RealPlayer = trouble?
How unexpected!
Comment removed based on user account deletion
"RealNetworks' RealPlayer media player, a software program installed on tens of millions of Windows computers worldwide..."
Heh heh... not on mine, sonny boy. Never on mine.