Real Player zero day
I wrote yesterday about a zero day possibly targeting NASA. This morning Symantec posted news of a Real Player exploit on the loose.
"The issue affects an ActiveX object in the RealPlayer component ierpplug.dll." While there is no patch available, you can set activeX kill bits. (Google for how to do that). I am deploying that in my enterprise now.
0 TrackBacks
Listed below are links to blogs that reference this entry: Real Player zero day.
TrackBack URL for this entry: http://www.infosecblog.org/mt-tb20071121.pl/612
2 Comments
Leave a comment
Powered by Ajax Comments
RealNetworks has issued a patch for this vulnerability that users can download here - http://service.real.com/realplayer/security/191007_player/en/
For more information about these patches and how the new RealPlayer has been improved, please visit the RealPlayer blog at www.realplayer.com/blog.
Matt Spragins
Real Networks
Yep, you guys got that out really fast. I blogged about that here: http://www.infosecblog.org/2007/10/real-fix-available.html but I neglected to set a trackback or update this post. I've had limited time this week.
thanks for the link to the real blog, I wasn't aware of that.