With attack code circulating, RealPlayer fix coming
98682
One day after Symantec&#160;researchers discovered software that attacked a critical&#160;unpatched vulnerability in RealNetworks&#39; media player, Real says that a fix for the issue is imminent.&quot;Real has created a patch for RealPlayer 10.5 and RealPlayer 11 that addresses the vulnerability identified by Symantec,&quot; wrote RealNetworks General Manager of Product Development Russ Ryan, in a Friday blog posting. &quot;Real will make this patch available to users via this blog and our security update page later today.&quot;Users of RealOne Player, RealOne Player v2, and RealPlayer 10 should upgrade to the 10.5 version of the product or the RealPlayer 11 beta code and should install the patch, Ryan said.The attack exploits a flaw in an ActiveX browser helper object, software that RealPlayer employs to help users who are experiencing technical difficulties, so the PC must be using the Internet Explorer browser to be affected by this particular attack, Symantec said.The attack only works on Windows systems, RealNetworks said. Linux, Mac and RealPlayer 8 users are not affected.Attackers were using a complicated network of advertising Web sites to launch the attack from a Web site that has been spotted hosting malicious code several times over the past two years, Symantec said.&quot;The exploit itself is embedded in advertisements that were being served by 247realmedia.com,&quot; Symantec said in a note on its DeepSight threat management system. &quot;The redirection to the exploit page... was accomplished through an iFrame embedded in each advertisement.&quot;Iframe is an HTML command that allows developers to insert a second Web page into the page being viewed. It is often used by malware creators because these iFrame pages can be as small as 1 pixel, making them invisible to the naked eye.Users who do not have the patch can turn off ActiveScripting within IE as a workaround to the problem. Very technical users can also set kill bit on the Class identifier (CLSID) FDC7A535-4070-4B92-A0EA-D9994BCC0DC5 to disable the ActiveX control, Symantec said.&#160;
468129
A consumer advocacy group is blasting RealNetworks for installing adware and other software without properly notifying its users.In a report published Thursday, StopBadware.org faults the latest version of RealPlayer for secretly installing its Rhapsody Player Engine during the RealPlayer installation.&quot;RealPlayer 11 does not disclose that it installs Rhapsody Player Engine, and does not remove the software when RealPlayer is uninstalled,&quot; Stopbadware says in the report.Rhapsody Player Engine is required to access RealNetwork&#39;s online music service. But because users are not told that they have installed the product it could become a liability, using up the computer&#39;s hard-drive space or processing power, or even creating a security risk for consumers if bugs are discovered in Rhapsody, said Maxim Weinstein, StopBadware&#39;s manager.Both RealPlayer 11 and the older RealPlayer 10.5 software are both considered &quot;badware,&quot; the report states.Real Player 10.5 suffers from a different issue, however. Users who download the software without filling out the RealNetworks product registration page end up with a piece of software called Message Center, which then proceeds to deliver ads to the user&#39;s computer. &quot;It&#39;s installing, essentially, a piece of adware without giving users information about that up front,&quot; Weinstein said.RealNetworks spokesman Ryan Luckin said a check-box on the registration page is used to notify users that Message Center would be installed. Users who clicked through the registration page without filling out any information would have the software installed.Although the issue was fixed in version 11 of the player, RealPlayer 10.5 is automatically downloaded via the Firefox browser&#39;s &quot;Missing Plug-in&quot; feature and is still widely used, Weinstein said.Until RealNetworks is up-front with users about what software they&#39;re actually downloading, StopBadware recommends that consumers avoid its media player.Luckin called the Rhapsody issue an oversight. &quot;The fact that when you uninstall RealPlayer we don&#39;t go back and uninstall Rhapsody is an oversight and is something we should address in the future,&quot; he said.A widely used alternative to Apple&#39;s QuickTime and Microsoft&#39;s Windows Media Player, RealPlayer has a history of making invasive changes to users&#39; computers. The Message Center software has come under fire in the past, and in 1999 computer security consultant Richard Smith discovered that the software was quietly sending information to RealNetworks servers.StopBadware&#39;s findings apply only to the Windows versions of RealPlayer&#39;s software, Weinstein said. RealPlayer also runs on other operating systems, including Mac OS X and Linux.Supported with funding from Google, Lenovo and Sun Microsystems, StopBadware evaluates software and warns consumers of products that engage in deceptive behavior, such as tracking user behavior or installing programs without telling consumers.Although RealPlayer 10.5&#39;s Message Center feature may be more noticeable and annoying, Weinstein said Real Networks should fix both problems as soon as possible. &quot;It&#39;s hard to say that one is worse,&quot; he said. &quot;They&#39;re really two sides of the same concept of just not telling users what&#39;s going on.&quot;
86222
In brief Exploit circulating for unpatched vuln
697974
Secunia has released an advisory for PHP today related to an issue caused by an integer overflow that could allow for bypassing of security of an application.   A weakness and a vulnerability have been reported in PHP 5, where the vulnerability has unknown impact and the weakness can be exploited by malicious, local users to bypass certain security restrictions.   The issue is caused by issues with the chunk_split and realpath functions that can lead to a bypass of the open_basedir restriction on a server.   The issue is marked as "moderately critical" and it is suggested that users update to PHP 5.2.3 to correct the issue.
192191
Users of the music player should watch out for hacked themes; a flaw allows would-be intruders to take control of PCs.
447903
This Quicktime buffer overflow vulnerability appears to be different from a similar vulnerability  patched by Apple in December 2007.
295779
Blog: Low ransom request and a self-termination date on the code suggest this is a test attack.
45482
Blog: Many of the patches address flaws within Quicktime for Java.
632521
Better install Microsoft's latest patches--hackers have posted attack code to exploit the flaws in Works.
27813
One day after Symantec Corp. researchers discovered software that attacked a critical unpatched vulnerability in RealNetworks Inc.'s media player, Real says that a fix for the issue is imminent.
23096
Attackers are exploiting an ActiveX bug in Yahoo's Jukebox music player, Symantec says.
577570
Hostilities started in late July, when Real cracked Apple&#39;s FairPlay code, meaning songs bought from the RealPlayer Music Store could be played on the iPod - a move that went down very badly over at Apple. Real then decided to ratchet up the pressure by ...
294393
Security update to QuickTime 7.1.6 patches two issues with the way QuickTime interacts with Java.
688722
Sample code that exploits a yet-to-be-fixed Windows flaw is circulating. Microsoft plans to deal with it on the next Patch Tuesday.
457591
Hackers revealed exploit code for JavaScript vulnerability.
377359
Digital tracks may help pinpoint Potter leaker &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
365555
InfoWorld - SymantecÂ is warning users of the RealPlayer media software to be extra careful while surfing the Web.