Over the weekend, attackers exploited a RealPlayer zero-day flaw to gain control of Windows systems through Internet Explorer. The flaw allowed the download and the execution of Trojan.Zonebac, which lowered the security settings in Internet Explorer, making it easier to carry out future attacks on the user's system.
Symantec issued the warning late Thursday noting that this is not the first time a flaw in the component, known as ierpplug.dll, has been reported. Last December, a security researcher was able to exploit the component to achieve a denial of service.
Reports of the spreading exploit code were promptly quashed today, however, when RealNetworks released a patch to address the security hole found in the Windows versions of RealOne Player, RealOne Player version 2, RealPlayer 10.5 and RealPlayer 11 beta - RealPlayer 8 or earlier versions in Windows as well as Linux and Macintosh versions of RealPlayer are not affected. If you are using one of the affected versions, Symantec and RealNetworks urge to install the latest patch as soon as possible.