US-CERT is warning computer users of a possible problem with the latest version of RealPlayer after a Russian security company claimed to have found a way to exploit a critical flaw in the multimedia software. US-CERT (United States Computer Emergency Readiness Team) published its warning on Wednesday, the day after Gleg chief technology officer Evgeny Legerov announced the exploit code in a posting to the Daily Dave security discussion list.
The flaw affects the latest version 11 of RealPlayer running on Windows XP, service pack 2, according to Gleg. A Flash demonstration of the vulnerability has been posted to the Gleg Web site, but the company has not released its attack code or any technical details of the flaw. Legerov discovered the flaw, called a stack overflow bug, during an audit of the RealPlayer source code, he said via e-mail.