IE users beware: RealPlayer zero-day flaw under attack

ZDNet ^ | October 19th, 2007 | Ryan Naraine

[holymoly]

Hackers are actively exploiting a zero-day hole in RealNetworks’ RealPlayer media player, a software program installed on tens of millions of Windows computers worldwide.

RealPlayer zero-day flaw under attack

The in-the-wild attacks, which began late last night (October 18), targets a previously unknown and unpatched ActiveX vulnerability in the way RealPlayer interacts with Microsoft’s Internet Explorer browser.

The flaw is causing drive-by malware downloads when an IE user simply browsers to a maliciously rigged Web page, according to an alert issued by anti-virus vendor Symantec.

The issue affects an ActiveX object installed by RealPlayer, accessible over the web using Internet Explorer. By instantiating the object and invoking a specific method and attacker is able to corrupt process memory and execute arbitrary code with the privileges of the browser. The attack currently known to be in-the-wild has been confirmed to download malicious code to the compromised host.

According to sources tracking this threat, the attacks are limited in nature and appear to be targeting specific organizations. Some government agencies, including NASA, have reportedly banned the use of Internet Explorer in response to this incident.

“The malware appears to be spreading through a large variety of common and highly-respected Internet sites, however it does not appear these sites are themselves infected. The affected sites are serving solely as a mechanism to attract potential victims.”

Confirmed vulnerable: RealPlayer versions 6.0.14.544, 6.0.14.550 (11 Beta), 6.0.12.1662 (10.5), 6.0.12, 6.0.11, and 6.0.10.

TEMPORARY MITIGATION:

In the absence of a patch from RealPlayer, users might want to consider uninstalling the software immediately. Or, use an alternative Web browser (Mozilla Firefox or Opera) for Web surfing.

Symantec also recommends:

• Block access to the IPs 83.149.65.105 and 66.199.254.193, as these IP addresses were observed partaking in the attack and have also been observed by honeypots perpetrating other malicious activity.

• Set the kill bit on the Class identifier (CLSID) FDC7A535-4070-4B92-A0EA-D9994BCC0DC5 (Microsoft instructions for setting kill bit).

• Ensure that all Microsoft Internet Explorer clients are configured to prompt before executing Active Scripting. If Active Scripting is not required it should be disabled completely.

• Ensure that all Microsoft Outlook and Outlook Express clients are configured to either display all incoming email in plain text format, or that HTML email messages are opened in the Restricted sites security zone.

• As most vulnerabilities of this nature rely on JavaScript to carry out exploitation, disable JavaScript whenever possible.

• Always execute web browser software as a user with minimal system privileges.

[holymoly]

In the absence of a patch from RealPlayer, users might want to consider uninstalling the software immediately. Or, use an alternative Web browser...

Firefox

Opera

Seamonkey

[fremont_steve]

Or an alternate OS like Linux ;-)

[Nervous Tick]

I’ve been avoiding RealPlayer for years, for reasons I don’t even clearly recall. I think it was because they became a PITA with all their spam and reminder popups or something to that effect.

[Ron in Acreage]

Don’t use RealPlayer at all. I believe it’s owned by Maria Cantwell, the flaming leftist democrat in the US Senate or some other notable leftist.

[SubGeniusX]

Hackers are actively exploiting a zero-day hole in RealNetworks’ RealPlayer media player, a software program installed on tens of millions of Windows computers worldwide.

PING

[Squawk 8888]

Not a problem for me- I use Firefox and never had a use for RealPlayer.

[Crazieman]

I haven’t touched realplayer since 2000

[Revel]

Use Real Alternative instead. It does not alway work. But I just figure that if a web site demands using Real player with so many better choices out there then why visit that web site. Real player is a bloated piece of spy ware. It has been so for years.

[Squawk 8888]

You’re not missing anything. The only thing it can do that the other players can’t is play RealMedia content. Anything on rm that’s worth playing is also available in other formats.

[LIConFem]

    In hoc signo vinces!

;o)

[Revel]

Real Alternative (Uses and old version of windows media player):

http://www.free-codecs.com/download/Real_Alternative.htm

[Red Badger]

I don’t have to worry. I use Windows Media Player................

[Just another Joe]

good thing I have version 10.5.

Or are they talking about build not version?

[mysterio]

[FourtySeven]

< sigh > Something to do when I get home I guess.

Yet another reason to get a Mac.

[tomh68]

Has nothing to do with the OS. It’s the browser specifically IE.

[pillut48]

In English please? :-)

I use Firefox but IE occasionally because some websites don’t work in Firefox (like my daughter’s soccer website)—if I go to “Add/Remove Programs” what should I remove? RealPlayer by itself? Or are other aspects needing to be removed as well?

My husband HATES “MicroShaft” as he calls it, but 90% of the programs/applications I use aren’t available on Linux yet—soon though I hope!!

[VeniVidiVici]

Real Player turned into malware itself years ago.

[PAR35]

# Block access to the IPs 83.149.65.105 and 66.199.254.193, as these IP addresses were observed partaking in the attack and have also been observed by honeypots perpetrating other malicious activity.
# Set the kill bit on the Class identifier (CLSID) FDC7A535-4070-4B92-A0EA-D9994BCC0DC5 (Microsoft instructions for setting kill bit).

I'm sure glad that IE is easy to use and configure than other operating systems. /sarcasm

[zencat]

Real Player turned into malware itself years ago.

Eyup. It simply became a terrible product slated more at pushing advertising.

Pretty much Windows Media or Quik Time today.