Slashdot Mirror
RealPlayer Zero-Day Flaw Under Attack
openOption writes "ZDNet is reporting that hackers are actively exploiting a zero-day hole in RealNetworks' RealPlayer media player, a software program installed on tens of millions of Windows computers worldwide. The in-the-wild attacks targets a previously unknown and unpatched ActiveX vulnerability in the way RealPlayer interacts with Microsoft's Internet Explorer browser. The flaw is causing drive-by malware downloads when an IE user simply browsers to a maliciously rigged Web page."
Used by no one... until now.
Greased up Yoda doll
Puckered anus
GO LINUX!
a software program
I like software programs. They run well on my computer PC and look nice on my display monitor. My computer PC works well, all the way from the electric power cable to the Ethernet network card, the hard disk hard drive, and my wireless keyboard keyboard and mouse mouse.
(What are synonyms for keyboard and mouse?)
God, I'm so glad I bought a computer with Windows XPN, which thanks to the wisdom of the European Union and RealNetworks' claims of unfair competition against their cuasi-malware player, does not include Windows Media Player! Yes, instead the OEM installed... oh, wait. They installed RealPlayer. Holy sh #$!@&*^} NO CARRIER
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
I don't want to be a troll, but people who install Real Player are asking for trouble.
Wow, I just had a scary thought I managed to block just in time before passing out: Real Player. On Vista.
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
The vulnerability doesn't affect IE in protected (sandboxed, default) mode on Vista, of course.
It's time to realise that Abble's products are the biggest abomination these days. Just say NO to the dumb iAbble way!!
...that the viruses using this attack were still easier to uninstall than RealPlayer itself.
Before you mod me funny, think, perhaps I was insightfully funny?
Real has posted a video press release on this. I would like to tell you more, but it's still buffering. Maybe they should use Media Player for their press releases.
Gamingmuseum.com: Give your 3D accelerator a rest.
It's going to take a while for the virus to stop buffering....
http://www.free-codecs.com/download/Real_Alternative.htm
Now I just have to worry about unpatched holes in Windows Media Player!
Truthfully, I already have one bloated Media Player that is part of the OS on my machine, why would I want to install another?
BTW:
http://www.free-codecs.com/download/QuickTime_Alternative.htm
To take care of that OTHER bloated media player
New marketing name -> RealTrojans (or viruses/worms, whatever). Sales are UP!
Nobody uses Vista because Vista's not compatible with Windows.
All 5 people who still have Real Player installed are in for a world of hurt...
We have four boxes with which to defend our freedom: the soap box, the ballot box, the jury box, and the cartridge box.
This vulnerability has nothing to do with ActiveX. ActiveX is just one method of hosting a plugin. Any method of hosting a plugin would be exactly as vulnerable. Anytime a browser accepts data from an outside source and passes it onto a library to handle that is a possible point of attack. There have been plenty of vulnerabilities found in non-ActiveX plugins for Internet Explorer and other browsers. There have been vulnerabilities found in the very libraries used by the browsers to display common content like images.
This is why the Vista approach is the correct approach: sandbox the browser. The process should be locked down so tight that when a vulnerability is inevitably discovered that the damage it can cause is mitigated. Every OS and every browser needs to incorporate these mechanisms by default.
The flaw is causing drive-by malware downloads when an IE user simply browsers to a maliciously rigged Web page.
I like the use of the word browser as a verb.
Also, drive-by malware downloads? This hood is no longer safe, yo!
Small though it is, the human brain can be quite effective when used properly.
overflow exploit, right?
Last time I saw real player was when I installed google pack on a windows machine years ago. I love picasa and google earth, and at the time a few of the other packages seemed like nice things to get all in 1 install. Real player was the deal killer- I never could figure out what good it was. It seems like it spent more of my time and CPU cycles trying to sell me on an upgrade than doing anything useful. What was/is google thinking on that one?
You seem to be inexplicably tense. Perhaps you should relax for a while and watch a television program.
Or go to the theater, and watch a play. If you have any trouble understanding it, you might find more in the program they give you. Hold on to it, they're collectible.
Whatever you do, though, don't rely on alcohol to relieve your anxiety. If you become dependant on it, you may need a twelve-step program to get yourself back on track.
The US free market: two halves of a government-granted duopoly are free to set the market price.
Come on, I love verbing words.
Your ad here. Ask me how!
The evil Realplayer is still required for some MIT open courseware. They should convert those files ASAP.