We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Real patches player

Fix promises to seal up security holes

RealNetworks has released a software patch that it says finally fixes highly publicised security holes in its RealOne Player.

The patch closes nine security holes that could allow an attacker to take over a computer running the RealOne Player, according to RealNetworks.

The vulnerabilities, described as "buffer overruns", were first discovered in November by Mark Litchfield, a British security researcher for Next Generation Security Software. In buffer overrun attacks, malicious hackers can exploit an unchecked buffer in a program to load and run their code on the vulnerable system.

Litchfield promptly reported the problems he found to RealNetworks.

In order to be vulnerable to an attack that took advantage of the flaws, users first would have to be tricked by attackers into downloading a malformed file. RealNetworks said in its statement that no exploitations of the security holes have yet been reported.

Nevertheless, RealNetworks issued a patch for the vulnerabilities in late November.

"All security vulnerabilities are taken very seriously by RealNetworks," said the company in its statement on Wednesday.

But Litchfield said he was able to prove that the patch issued by RealNetworks did not solve the reported security problems.

The mix-up prompted RealNetworks to announce a wholesale review of its RealOne Player source code to identify any other vulnerabilities in the product.

Although the results of that audit were not mentioned in the company's statement, it says the nine holes have been plugged.

RealOne Player users can obtain the update by selecting the Check for Updates option on the RealOne Player's tools menu, or by downloading the software patch here.

IDG UK Sites

How to use an Apple Watch: Everything you need to know about the Apple Watch

IDG UK Sites

Why Scottish Tablet is better than the iPad mini

IDG UK Sites

How Microsoft's HoloLens AR headset will work without needing a computer or phone

IDG UK Sites

Apple MacBook 1.1 GHz review (Retina, 12-inch, Early 2015): The future of Apple laptops