UGN Security Forums
My ProfileMember DirectoryLogin
Search our ForumsView our FAQView our Site Rules
View our CalendarView our Active TopicsGo to our Main Page

UGN Security Store
 

Network Sites UGN Security, The GoNix Initiative, Elite Web Gamers, Back of the Web, EveryDay Helper, VNC Web Design & Development
Sponsored Links
Latest Postings
Latest Reviews
Topic Options
Rate This Topic
#37382 - 11/26/02 08:23 PM RealNetworks pulls media player patch
Le4rner Offline
UGN Supporter

Registered: 03/05/02
Posts: 562
RealNetworks has pulled down a patch that aimed to fix flaws in its popular media player software after the developer who discovered the problems said the fix doesn't work.

The vulnerabilities, which appear in the streaming media company's RealOne Player and Real Player, could affect as many as 115 million users of the software worldwide.

RealNetworks posted a patch last week, but NGSSoftware engineer Mark Litchfield on Tuesday said he was able to easily work around the fixes by making relatively minor changes to his attacks on the software.



"Whatever they did is not sufficient," Litchfield said, adding that he's still working with the company on a better patch.

The three flaws could result in what's known as a "buffer overflow," a memory problem that could compromise security controls and theoretically allow an attacker to take control of a PC running the Real media player.

The intruder could exploit the security holes by encouraging unsuspecting PC users to download files with overly long file names or other distorted features, according to NGSSoftware, the security company that first discovered the flaws.

RealNetworks said that the problems were only theoretical at this point and that the discoverer of the security holes could not actually demonstrate how to exploit the bugs to take over a PC.

"We have not yet received reports of anyone actually being attacked with this exploit," RealNetworks said in a posting on its Web site.

NGSSoftware notified the Seattle-based streaming media company of the problems Nov. 1, but kept the findings a secret until RealNetworks could post a patch for them. The U.K.-based security company sent its findings to the NTBugtraq mailing list after RealNetworks first said it fixed the flaws.

RealNetworks representatives did not immediately return calls seeking comment on the patch problems.

http://zdnet.com.com/2100-1104-975352.html
_________________________
http://promodtecnologies.com/rrfn

Top
Sponsored Links
      
#37383 - 11/26/02 09:27 PM Re: RealNetworks pulls media player patch
jonconley Offline
UGN Super Poster

Registered: 10/08/02
Posts: 955
Loc: Merrill, IA, USA
I just wanna say I hate realone player. It keeps taking over associations even after I unassociate them. I only have the player b/c I need to codec to convert .rm to .mp3 with streambox ripper. I personally do not trust real networks at all. Above is an example, and they have had a history of violating people's privacy rights.

Do yourself a favor. Boycott using their system. If someone's website serves/streams only in realmedia, then email the webmaster/admin and let them know. Quote some of the articles that show violations of privacy or security holes such as above. Also, being proprietary sucks ass. There were a few players that could play real media, but they complained.

Top

Featured Member
Registered: 10/28/14
Posts: 1
Forum Stats
2149 Members
46 Forums
35352 Topics
70522 Posts

Max Online: 1567 @ 04/25/10 05:20 AM
Top Posters
UGN Security 28513
Gremelin 7193
§intå× 3255
SilentRage 1273
Ice 1146
pergesu 1136
Infinite 1041
jonconley 955
Girlie 908
unreal 860
Newest Members
Tim050, Gecko666, defghi795767, Devo60, ali
2148 Registered Users
Who's Online
0 registered (), 397 Guests and 317 Spiders online.
Key: Admin, Global Mod, Mod
Latest News
luxury goods sales at $405B by 2019
by golqm
10/28/14 05:19 AM


Donate
  Get Firefox!
Get FireFox!