[Steve]

The Symantec Security Response team has uncovered new attack code that affects the RealPlayer 11 beta and RealPlayer 10.5 software on the Windows platform. Symantec has tested the attack and confirmed that it worked on the English version of Windows XP Service Pack 1 running Internet Explorer 6. Tests for the more-recent XP service pack 2 and IE 7 browser are ongoing.

A cybercriminal would have to trick the victim into playing a video or audio source on a maliciously encoded Web page. The flaw lies in a browser helper object, software that RealPlayer uses to help users who are experiencing technical difficulties.

Symantec suggests that once the exploit is run on the victim's machine, it is suggested that the attacker can download and install whatever software he or she wants to install on the target machine.

The Firefox web browser (updated to 2.0.0.8 today) is reported to be not affected by this issue - and may be considered a safer alternative when viewing pages with Real Player content.