Security Best Practice: Blocking RealNetworks RealPlayer

Vulnerability
Protection

Check Point Reference:	SBP-2009-08
Date Published:
Severity:
Source:	SmartDefense Research Center
Industry Reference(s):	CVE-2009-0375 CVE-2008-3066 CVE-2007-5601 CVE-2005-2052 CVE-2005-1766
Protection Provided by:	Security Gateway R70 VPN-1 NGX R65 NGX R62 NGX R61 NGX R60 VSX NGX R65
Who is Vulnerable? RealNetworks RealPlayer users
Vulnerability Description RealNetworks RealPlayer is a cross-platform media player that supports multiple multimedia formats such as: MP3, MPEG-4, QuickTime, Windows Media, and RealAudio and RealVideo formats. RealPlayer contains many features including streaming capabilities, media browser, video download, and CD ripping. The use of RealPlayer may circumvent the organizational security policy.

Vulnerability Details
Some organizations prefer to prevent their employees from using media player applications, since they tend to lower employee productivity. Also, video downloading and streaming traffic significantly increase a company’s Internet communication costs and might force it to purchase additional bandwidth.

RealPlayer is prone to multiple vulnerabilities. The impacts of these vulnerabilities could range from denial of service attacks to the execution of malicious code on a victim's system.

An example of a vulnerability in RealPlayer can by found in CPAI-2008-061:
The RealPlayer playlist handling buffer overflow vulnerability is due to an error in a RealPlayer ActiveX control that fails to properly handle playlist names. To trigger this issue, an attacker may entice a user to enter a malicious web page. Successful exploitation may allow execution of arbitrary code on a vulnerable system.

Protection Overview
This protection will detect and block the access to RealPlayer media traffic.

In order for the protection to be activated, update your Security Gateway/VPN-1 product to the latest IPS/SmartDefense update. For information on how to update IPS/SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway R70

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Application Intelligence > Media Players.
2. In the right pane, double-click the RealNetworks RealPlayer protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name : Media Player Enforcement Violation
Attack Information : RealPlayer detected on connection

VPN-1 NGX R65 & R62

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > Media Players.
2. Select the following:

RealNetworks RealPlayer

3. In the configuration pane, under Settings > Mode, check Active.
4. Install policy on all modules.

VPN-1 NGX R61 & R60

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > Media Players.
2. Select the following:

RealNetworks RealPlayer

3. Install policy on all modules.

VPN-1 VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > Media Players.
2. Select the following:

RealNetworks RealPlayer

3. In the configuration pane, under Settings > Mode, check Active.
4. Install policy on all modules.

Legal Notice for Threat Center Advisories