PT-2004-1849 · Realnetworks · Realnetworks Helix Universal Server

Published 2004-10-16 · Updated 2017-07-11 · CVE-2004-0774

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions RealNetworks Helix Universal Server version 9.0.2 for Linux RealNetworks Helix Universal Server version 9.0.3 for Windows

Description The issue allows remote attackers to cause a denial of service, resulting in CPU and memory exhaustion. This can be achieved via a POST request with a Content-Length header set to -1.

Recommendations For RealNetworks Helix Universal Server version 9.0.2 for Linux, restrict access to the server to prevent remote attackers from sending malicious POST requests. For RealNetworks Helix Universal Server version 9.0.3 for Windows, consider implementing validation for the Content-Length header to prevent it from being set to -1. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-0774

Affected Products

Realnetworks Helix Universal Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2004-0774 · Security Note
• http://idefense.com/application/poi/display?id=151&type=vulnerabilities · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17648 · Note