RealNetworks Helix Universal Server RTSP Transport Buffer Overflow Vulnerability

Bugtraq ID:	6454
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 20 2002 12:00AM
Updated:	Dec 20 2002 12:00AM
Credit:	Vulnerability discovery credited to Mark Litchfield of NGSSoftware.
Vulnerable:	RealNetworks Helix Universal Server 9.0
Not Vulnerable:	RealNetworks Helix Universal Server 9.0 1

RealNetworks Helix Universal Server RTSP Transport Buffer Overflow Vulnerability

Helix Universal Server is a multiple type media server distributed and maintained by RealNetworks. It is available for Unix, Linux, and Microsoft Windows platforms.

A buffer overflow has been reported in the Helix Universal Server. Due to insufficient bounds checking on the 'transport' field of a RTSP request, it is possible for a user to exploit a boundry condition error. This could lead to the remote execution of arbitrary code with the privileges of the Helix Universal Server process.

RealNetworks Helix Universal Server RTSP Transport Buffer Overflow Vulnerability

An exploit written by Johnny Cyberpunk <[email protected]> is available:

• /data/vulnerabilities/exploits/THCunREAL.zip

RealNetworks Helix Universal Server RTSP Transport Buffer Overflow Vulnerability

Solution:
RealNetworks has made a fixed version available:


RealNetworks Helix Universal Server 9.0

• Real Networks Helix Universal Server 9.01
  http://www.service.real.com/downloads.html

RealNetworks Helix Universal Server RTSP Transport Buffer Overflow Vulnerability

References:

• Potential Buffer Overrun Vulnerabilities in Helix Universal Server 9.0 (RealNetworks)
  
• RealNetworks HELIX Server Buffer Overflow Vulnerabilities (#NISR20122002) ("NGSSoftware Insight Security Research" )