Latest flaw in real player

US-CERT (United States Computer Emergency Readiness Team) published its warning on Wednesday, the day after Gleg chief technology officer Evgeny Legerov announced the exploit code in a posting to the Daily Dave security discussion list.

The flaw affects the latest version 11 of RealPlayer running on Windows XP, service pack 2, according to Gleg. A Flash demonstration of the vulnerability has been posted to the Gleg Web site, but the company has not released its attack code or any technical details of the flaw.

Legerov discovered the flaw, called a stack overflow bug, during an audit of the RealPlayer source code, he said via e-mail.

Gleg sells “penetration testing” software that can be used by security professionals to find holes in computer networks. The RealPlayer flaw was added to Gleg’s VulnDisco SA software on Dec. 16, which means that subscribers have had access to the code for more than two weeks. VulnDisco SA is sold as an add-on to Immunity’s Canvas penetration testing platform.

There have been no reports of the code being released to the general public so far. US-CERT has not been able to study the exploit code and confirm that it works, said Art Manion, vulnerability analysis team leader at US-CERT.

Real is working to confirm whether the exploit code actually works, a company spokesman said Wednesday.

US-CERT is doing the same thing, Manion said. In the meantime, RealPlayer users should be cautious. “If one wants to assume the most cautious possible stance, you don’t use it,” Manion said.

Related posts:

1. Microsoft is warning customers about a zero-day flaw
2. Update on Windows 2000/2003 Critical DNS Flaw
3. Input validation flaw in internet explorer
4. Websites feast on Windows flaw
5. New Windows vulnerability discovered
6. Zero dat vulnerability

Related posts brought to you by Yet Another Related Posts Plugin.