PT-2006-4170 · Realnetworks · Helix Dna Server

Publicado 2006-06-28 · Atualizado 2017-07-20 · CVE-2006-3276

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RealNetworks Helix DNA Server versions 10.0 through 11.0

Description The issue is related to a heap-based buffer overflow that allows remote attackers to execute arbitrary code. This can be achieved via a long User-Agent HTTP header in the RTSP service or through unspecified vectors involving the parsing of HTTP URL schemes.

Recommendations For versions 10.0 through 11.0, consider disabling the RTSP service or restricting access to it until a patch is available. Additionally, as a temporary workaround, restrict the length of the User-Agent HTTP header to prevent exploitation.

Correção

Identificadores relacionados

CVE-2006-3276

Produtos afetados

Helix Dna Server

Referências · 10

• http://vupen.com/english/advisories/2006/2521 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0600.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27316 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3276 · Nota de Segurança
• http://secunia.com/advisories/20784 · Aviso do Fabricante
• http://labs.musecurity.com/advisories/MU-200606-01.txt · Nota
• http://osvdb.org/26799 · Nota
• http://securitytracker.com/id?1016365 · Nota
• http://securityfocus.com/bid/18606 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27317 · Nota