Elazar Broad has discovered a vulnerability in RealPlayer, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error within the RealPlayer ActiveX Control (rmoc3260.dll) when handling the "Console" property. This can be exploited to cause a memory corruption and execute arbitrary code when a user e.g. is tricked into visiting a malicious website.

The vulnerability is confirmed in RealPlayer version 11.0.1 (build 6.0.14.794) including rmoc3260.dll version 6.0.10.45. Other versions may also be affected.

Solution
Update to version 11.0.2 (build 6.0.14.802) via e.g. "Check for Update" in the "Help->About RealPlayer" menu.

Provided and/or discovered by
Elazar Broad

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2008-March/060659.html

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers