RealNetworks Helix Server Unspecified Remote Heap Buffer Overflow Vulnerability

Bugtraq ID:	27122
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jan 03 2008 12:00AM
Updated:	Jan 04 2008 09:09PM
Credit:	Evgeny Legerov is credited with discovering this issue.
Vulnerable:	RealNetworks Helix Server 11.1.6 RealNetworks Helix Server 11.1.4 RealNetworks Helix Server 11.1.2
Not Vulnerable:

RealNetworks Helix Server Unspecified Remote Heap Buffer Overflow Vulnerability

RealNetworks Helix Server is prone to a remote heap-based buffer-overflow vulnerability.

An attacker could leverage this issue to execute arbitrary code with the privileges of the user running the application. Successful exploits will compromise affected computers. Failed exploit attempts will likely result in denial-of-service conditions.

Very few details are currently available regarding this issue. We will update this BID as more information becomes available.

This issue affects Helix Server 11.1.6; other versions may also be affected.

RealNetworks Helix Server Unspecified Remote Heap Buffer Overflow Vulnerability

A Flash movie demonstrating an exploit of this issue is available at the following location:

http://gleg.net/realserver.html

RealNetworks Helix Server Unspecified Remote Heap Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RealNetworks Helix Server Unspecified Remote Heap Buffer Overflow Vulnerability

References:

• Real Networks Helix Server Homepage (Real Networks)
  
• Realserver Exploit Demo (Evgeny Legerov)