Real Customer Supportbypass navigation Customer Support

Customer Support - RealOne Security Updates

Updated July 10, 2002

On June 25, 2002, a security exploit affecting RealJukebox 2 and RealOne Player Gold was brought to the attention of RealNetworks.

The specific exploits are:

  1. Commonly known as a "buffer overrun", this could allow an attacker to run arbitrary code on a user's machine.
  2. This exploit could allow an attacker to load an HTML page in the My Computer security domain and execute code on the user's machine that would bypass the security settings of their browser.

We have not yet received reports of anyone actually being attacked with this exploit. However, RealNetworks, has found and fixed the problem.

The first bug is essentially a parsing error in the jukebox code associated with reading RJS skin files, commonly known as a "buffer overrun" bug which could theoretically be used by hackers to adversely affect users. The bug was fixed by improving the robustness of skin file parsing. When RealJukebox encounters files modified in the manner described by this exploit, it will ignore the corrupt information in the skin, and switch to the skin as specified.

The second bug is a problem in the skin loading mechanism for RealJukebox 2 where files are extracted to known locations. This issue was fixed by increasing dynamic nature of the extraction locations.

Affected Software:

  • RealOne Player Gold

    US for Windows

  • RealJukebox2

    Version 379 Japanese for Windows


    Version 340 US for Windows

  • RealJukebox 2 Plus

    Version 379 Japanese for Windows


    Version 340 US for Windows

Workaround:

We have not yet received reports of anyone actually being attacked with this exploit. To ensure that your RealPlayer is protected, we recommend installing the updates available.

RealOne Player Gold for Windows

Please click here for the download to install the update.

RealJukebox 2 for Windows

For the US version, please click here for the download to install the update.

For the Japanese version, please click here for the download to install the update.

RealJukebox 2 Plus for Windows

For the US version, please click here for the download to install the update.

For the Japanese version, please click here for the download to install the update.

To see this information in Japanese, please click here to download the pdf file.

Unfortunately, we are not able to provide updates for any earlier versions of RealJukebox 2 or RealOne Player at this time.

Warranty:

While RealNetworks endeavors to provide you with the highest quality products and services, we cannot guarantee and do not warrant that the operation of any RealNetworks product will be error-free, uninterrupted or secure. See your original license agreement for details of our limited warranty or warranty disclaimer.