Original URL: http://www.channelregister.co.uk/2007/10/20/realplayer_vuln/
IE + RealPlayer = Security hole
ActiveX also enters into the equation
Posted in Software & Security, 20th October 2007 00:11 GMT
Free whitepaper – Driving Situational Awareness:
If you have RealPlayer installed and use Internet Explorer to browse the web, beware: an exploit in circulation can allow an attacker to take complete control of your machine, Symantec is warning.
Attacks targeting the most recent version of RealNetworks' music and video player were first observed Thursday night. They exploit a vulnerability in the way RealPlayer interacts with IE, providing a stealthy means for miscreants to shoehorn their way into a user's PC.
"If you have RealPlayer installed, simply visiting a malicious Web page can put your computer at risk," a Symantec blog post [1] explains. "The player does not need to be running."
The ActiveX object being exploited resides in the the RealPlayer component ierpplug.dll. Attack code reviewed by Symantec causes RealPlayer to download and execute a copy of Trojan.Zonebac.
Until RealNetworks issues a patch, workarounds include:
- Set a kill bit in the Windows registry at FDC7A535-4070-4B92-A0EA-D9994BCC0DC5
- Configure IE to prompt before executing ActiveX scripts
- Configure Outlook and Outlook Express to display email in plain text or to open HTML messages in the restricted sites security zone.
Another option is to use Firefox as your primary browser, preferably along with the NoScript [2] add-on. ®