- http://secunia.com/advisories/29315/
Release Date: 2008-03-11
Critical: Highly critical
Impact: System access
Where: From remote
Solution Status: Unpatched
Software: RealPlayer 11.x …
…The vulnerability is confirmed in RealPlayer version 11.0.1 (build 6.0.14.794) including rmoc3260.dll version 6.0.10.45. Other versions may also be affected.
Solution: Set the kill-bit for the affected ActiveX control…
- http://isc.sans.org/diary.html?storyid=4120
Last Updated: 2008-03-11 12:23:41 UTC - "Real player is probably installed on many of your computers, and an exploit for an unpatched vulnerability was made public on the full-disclosure mailing list.
As a result, those using ActiveX capable browsers (read: MSIE) are vulnerable to attack, with no patch on the horizon yet.
Workarounds:
* Set killbits for:
rmoc3260.dll version 6.0.10.45
{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93}
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}
But this will also remove the genuine functionality of the player.
* Use a browser that doesn't support ActiveX (there's plenty of those)…"
- http://preview.tinyurl.com/2e4dth
March 24, 2008 (Symantec Security Response Weblog) - "…Recently, we observed some suspicious activity on the Chinese Yahoo astrology site, hxxp: //astrology. cn.yahoo .com. Upon investigation, we determined that the site in question contained an iframe that was linking to the domain luckty.com, an astrology-based match finding company. This page contained an embedded iframe that linked to a malicious site that was exploiting the Real Player ierpplug.dll ActiveX Control Buffer Overflow Vulnerability and the MSIE ADODB.Stream Object File Installation Weakness to download malicious code onto a compromised machine. We contacted our friends at Yahoo, who subsequently removed all iframe references pointing to luckty.com…"
- http://secunia.com/advisories/29315/
Last Update: 2008-03-24
…The vulnerability is confirmed in RealPlayer version 11.0.1 (build 6.0.14.794) including rmoc3260.dll version 6.0.10.45. Other versions may also be affected…
Solution: Update to version 11.0.2 (build 6.0.14.802) via e.g. "Check for Update" in the "Help->About RealPlayer" menu…
