US-CERT warns of flaw in latest RealPlayer
The US-CERT is warning computer users of a possible
problem with the latest version of RealPlayer after a Russian security company
claimed to have found a way to exploit a critical flaw in the multimedia software.
US-CERT (United States Computer Emergency Readiness Team) published its warning
on Wednesday, the day after Gleg Ltd. Chief Technology Officer Evgeny Legerov
announced the exploit code in a posting to the Daily Dave security discussion
list.
The flaw affects the latest version 11 of RealPlayer running on Windows XP,
service pack 2, according to Gleg. A Flash demonstration of the vulnerability
has been posted to the Gleg Web site, but the company has not released its attack
code or any technical details of the flaw.
Legerov discovered the flaw, called a stack overflow bug, during an audit of
the RealPlayer source code, he said via e-mail.
Gleg sells "penetration testing" software that can be used by security
professionals to find holes in computer networks. The RealPlayer flaw was added
to Gleg's VulnDisco SA software on Dec. 16, which means that subscribers have
had access to the code for more than two weeks. VulnDisco SA is sold as an add-on
to Immunity's Canvas penetration testing platform.
There have been no reports of the code being released to the general public
so far. US-CERT has not been able to study the exploit code and confirm that
it works, said Art Manion, vulnerability analysis team leader at US-CERT.
Real is working to confirm whether the exploit code actually works, a company
spokesman said Wednesday.
US-CERT is doing the same thing, Manion said. In the meantime, RealPlayer users
should be cautious. "If one wants to assume the most cautious possible
stance, you don't use it," Manion said.
In October, criminals exploited another flaw in RealPlayer in order to sneak
unauthorized software onto victim's computers. That bug has been patched.
IDG News Service
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
