An unpatched bug in RealPlayer leaves the media player open to drive-by-download attacks, which hackers use to trick prospective marks into visiting maliciously constructed websites.

The vulnerability stems from coding errors in a RealPlayer ActiveX control (rmoc3260.dll), which enables content to be played within a user's Internet Explorer browser. The ActiveX control fails to properly handle multiple properties, including Console, creating a heap memory corruption risk.

RealPlayer version 11.0.1 is confirmed as vulnerable. Other versions of the media player may also be flawed. Security clearing house Secunia advises [1] users to kill the affected ActiveX control pending the availability of a patch from Real Networks. Instructions and pointers on how to disable RealPlayer ActiveX controls in Internet Explorer can be found in an advisory by US CERT here [2].

Details of the vulnerability were posted by its discoverer, Elazar Broad, on a full disclosure mailing list on Monday.

A similar vulnerability involving the interaction between RealPlayer and IE, but affecting a different ActiveX control, was discovered [3] last October. ®

Links

1. http://secunia.com/advisories/29315
2. http://www.kb.cert.org/vuls/id/831457
3. http://www.theregister.co.uk/2007/10/20/realplayer_vuln

Related stories

• High-priority patch fixes critical vulns in RealPlayer (25 July 2008)

  http://www.theregister.co.uk/2008/07/25/realplayer_vulns_patched/

• Mass SQL injection hits English language websites (21 May 2008)

  http://www.theregister.co.uk/2008/05/21/china_sql_injection_attack/

• Drive-by download attack compromises 500K websites (13 May 2008)

  http://www.channelregister.co.uk/2008/05/13/zlob_trojan_forum_compromise_attack/

• Mass compromise powers massive drive-by download attack (13 March 2008)

  http://www.theregister.co.uk/2008/03/13/mass_compromise/

• RealPlayer users warned over unpatched vuln (3 January 2008)

  http://www.theregister.co.uk/2008/01/03/realplayer_vuln/

• Real Media attacks real people via RealPlayer (23 October 2007)

  http://www.theregister.co.uk/2007/10/23/real_media_serves_malware/

• IE + RealPlayer = Security hole (20 October 2007)

  http://www.theregister.co.uk/2007/10/20/realplayer_vuln/

• Serious security hole plugged in RealPlayer and HelixPlayer (28 June 2007)

  http://www.theregister.co.uk/2007/06/28/realplayer_security_hole_plugged/

• Media players hit by buffer overflow glitch (4 April 2003)

  http://www.theregister.co.uk/2003/04/04/media_players_hit_by_buffer/