|
|
Last night we obtained a sample of a RealPlayer zero day exploit. RealPlayer 11 Beta, 10.5, and older versions are affected. Today’s DAT release, version 5145, contains detection under the name Exploit-RealPlay.a. At this point, exposure appears to be limited, but we can expect public exploit code to surface before too long. At that point exploitation is likely to follow the path of many other drive-by exploits and become fairly well distributed.
The vulnerability lies in a RealPlayer ActiveX control, and can be mitigated by setting the appropriate kill bit via the registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\
ActiveX Compatibility\{FDC7A535-4070-4B92-A0EA-D9994BCC0DC5}Â
While we generally keep this blog research focused (and shy away from mentioning products), zero day exploit announcements seem half-done without some mention of information on how our products deal with the threat.
McAfee product coverage information will be sent out via a McAfee Avert Labs Security Advisory service shortly. This includes coverage information for the following product lines.
|
|
Craig. What do you mean by “mitigated”? Mitigate means to reduce impact or severity. My reading of the kb article link suggests that the risk would be prevented completely.
ActiveX is a Microsoft technology, utilized by Internet Explorer for Windows. No other browser or operating system is affected by this vulnerability.
It looks like exploit for Windows versions of Real Player, isn’t it? AFAIR there’s no such thing as ActiveX in OS X version of RP…
Submit your own comments / message for this post