RealNetworks patches RealOne Player
RealNetworks Inc. has released a software patch that it says finally fixes highly publicized security holes in its RealOne Player, according to a statement released by the company on Wednesday.
The patch closes nine security holes that could allow an attacker to take over a computer running the RealOne Player, according to RealNetworks.
The vulnerabilities, described as "buffer overruns," were first discovered in November by Mark Litchfield, a security researcher for Next Generation Security Software Ltd., in Sutton, U.K. In buffer overrun attacks, malicious hackers can exploit an unchecked buffer in a program to load and run their code on the vulnerable system.
Litchfield promptly reported the problems he found to RealNetworks, which is based in Seattle.
In order to be vulnerable to an attack that used the flaws, users first would have to be tricked by attackers into downloading a malformed file. RealNetworks said in its statement that no exploitations of the security holes have yet been reported.
Nevertheless, RealNetworks issued a patch for the vulnerabilities in late November.
"All security vulnerabilities are taken very seriously by RealNetworks," RealNetworks said in its statement Wednesday.
However, Litchfield said he was able to prove that the patch issued by RealNetworks did not solve the reported security problems.
The mix-up prompted RealNetworks to announce a wholesale review of its RealOne Player source code to identify any other vulnerabilities in the product.
Although the results of that audit were not mentioned in the company's statement, the nine holes have been plugged, according to the company.
Individuals using RealOne Player can obtain the update by selecting the Check for Updates option on the RealOne Player's tools menu, or by visiting the RealNetworks Web site and downloading the software patch at http://service.real.com/help/faq/security/bufferoverrun_update.html.
ITworld.com
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
