RealNetworks.Helix.Server.RTSP.SET_PARAMETER.Buffer.Overflow

description-logoDescription

Helix is a project to produce software that can play audio and video media in various formats, aid in producing such media, and serve them over a network. It is intended as a largely free and open source digital media framework that runs on numerous operating systems and processors (including mobile phones) and was started by RealNetworks which has contributed much of the code.
The Helix Community is an open collaborative effort to develop and extend the Helix platform. Helix Client is the multi-platform multi-format media playback engine. Helix Player is a media player that runs on Linux, Solaris, Symbian and FreeBSD and is built on top of Helix Client. Helix Producer is an application that can aid in the production of media files, and Helix Server can stream media files over a network.
On December 16, 2008, RealNetworks, Inc. credited TippingPoint and Noam Rathaus CTO http://www.beyondsecurity.com for addressing the following potential security vulnerabilities:
Vulnerability 1:
ZDI-CAN-293: RealNetworks Helix Server RTSP DESCRIBE Heap Overflow Vulnerability
This vulnerability allows attackers to execute arbitrary code on vulnerable installations of RealNetworks Helix Server. User interaction is not required to exploit this vulnerability. Authentication is not required to exploit this vulnerability.
Vulnerability 2:
ZDI-CAN-323 DOS stack-based buffer-overflow vulnerability when parsing RTSP SETUP
Denial of Service can be triggered performing three consequent crafted requests on port 554 (default RTSP) of the server.
Vulnerability 3:
ZDI-CAN-333: RealNetworks Helix Server DataConvertBuffer Heap Overflow Vulnerability
This vulnerability allows attackers to execute arbitrary code on vulnerable installations of RealNetworks Helix Server. Authentication is not required to exploit this vulnerability.
Vulnerability 4:
ZDI-CAN-380: RealNetworks Helix Server NTLM Authentication Malformed Base64 Heap Overflow Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on systems with vulnerable installations of RealNetworks Helix Server. Authentication is not required to exploit this vulnerability

affected-products-logoAffected Products

Real Networks Helix Server 12.0
Real Networks Helix Server 11.1.7
Real Networks Helix Server 11.1.6
Real Networks Helix Server 11.1.4
Real Networks Helix Server 11.1.2
Real Networks Helix Mobile Server 12.0
Real Networks Helix Mobile Server 11.1.7
Real Networks Helix Mobile Server 11.1.6
Real Networks Helix Mobile Server 11.1.4
Real Networks Helix Mobile Server 11.1.2

Impact logoImpact

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of RealNetworks Helix Server. Authentication is not required to exploit the vulnerabilities.

recomended-action-logoRecommended Actions

Version 11.1.8 and Version 12.0.1 of the Helix Server and the Helix Mobile Server have been updated to ensure that the above vulnerabilities have been resolved.
SOLUTION:
The vulnerability is resolved on the following platforms by installing Version 11.1.8 or Version 12.0.1 of the Helix Server and the Helix Mobile Server. This only pertains to supported versions of the platforms listed below:
- Red Hat Enterprise Linux 4
- Sun Solaris 8/9/10
- Windows 2003
For FortiGate users, turning on the IPS signature RTSP.Command.Buffer.Overflow can prevent exploitation of this vulnerability.

Telemetry logoTelemetry

Coverage

IPS (Regular DB)
IPS (Extended DB)

Version Updates

Date Version Detail
2018-10-16 13.473 Sig Added