full-disclosure - RealPlayer 0-day exploit was found in malicious

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 10 Nov 2007 17:43:30 +0800 (CST)
From: lzscg <lzscg@....com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: RealPlayer 0-day exploit was found in malicious

Most vendors reported that RealPlayer 0-day exploit was found in malicious .html files, such as Symantec, Mcafee Avert Labs, etc. The issue affects an ActiveX object in the RealPlayer component ierpplug.dll. RealPlayer 11 Beta, 10.5, and older versions are affected. 

Symantec and Mcafee have added detection of this exploit as Trojan.Reapall and Exploit-RealPlay.a. 

As while, Real Company issued a fix for this vulnerability in less than 24 hours.

Quotation
RealPlayer 10.5 and RealPlayer 11 beta users should install the following patch click here to address this security vulnerability that aims to cause buffer overflow that could provide the potential for an attacker to run arbitrary or malicious code on a user’s PC.  

More details: http://service.real.com/realplayer/security/191007_player/en/

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/