[Steve]

The Symantec Security Response team has uncovered new attack code that affects the RealPlayer 11 beta and RealPlayer 10.5 software on the Windows platform. Symantec has tested the attack and confirmed that it worked on the English version of Windows XP Service Pack 1 running Internet Explorer 6. Tests for the more-recent XP service pack 2 and IE 7 browser are ongoing.

A cybercriminal would have to trick the victim into playing a video or audio source on a maliciously encoded Web page. The flaw lies in a browser helper object, software that RealPlayer uses to help users who are experiencing technical difficulties.

Symantec suggests that once the exploit is run on the victim's machine, it is suggested that the attacker can download and install whatever software he or she wants to install on the target machine.

The Firefox web browser (updated to 2.0.0.8 today) is reported to be not affected by this issue - and may be considered a safer alternative when viewing pages with Real Player content.

[Steve]

Following yesterday's warning, Real Media has provided a 'Critical' security update to the Windows version 10.5 of its RealPlayer product. Hackers are reported to be actively exploiting a “zero-day hole” in RealNetworks’ RealPlayer media player, which is installed on tens of millions of Windows computers worldwide. Macintosh and Linux versions of
RealPlayer are not at risk.

To obtain the latest Real Player update, select (in Windows) the command
[Start][Programs][Real][RealPlayer][Check for RealPlayer Updates].

The update attempts to offer the option of installing the security update only if you agree to register your name and details, but it's not necessary to do this to get the security update. If you don't want to register formally with Real Media as a user, simply (when prompted to do so at a 'Product Registration' screen) choose [Cancel] - then when prompted further to [Cancel Setup] choose [Exit]. At this point the small green RealPlayer
application launches, followed by a small animated panel showing that it is checking for updates. This should eventually reveal a further panel offering [Critical Updates]. Choose 'RealPlayer 10.5 with Harmony' and install it (it's 12.1 Mb in size). The update process may also offer the Google Toolbar - which you can elect to accept or reject. It also offers to put icons on the desktop for RealPlayer (which again you can accept or reject as desired it's not necessary to have them in order to make the software work).

Finally the update installer offers to 'Make RealPlayer your universal Media Player'. Again, you don't have to do this unless you want to. It's sufficient just to 'Select Media Types from a list' scroll through the list and associate Real Audio and Real Video filetypes (.rt, .ra, .rm etc) with RealPlayer.

At the end of the update process, you will be invited to restart your computer.

[MattSpragins]

RealNetworks has issued a patch for this vulnerability that users can download here -
Customer Support - Real Security Updates

For more information about these patches and how the new RealPlayer has been improved, please visit the RealPlayer blog at RealPlayer Blog.

Matt Spragins
Real Networks