PT-2006-4170 · Realnetworks · Helix Dna Server

Published 2006-06-28 · Updated 2017-07-20 · CVE-2006-3276

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RealNetworks Helix DNA Server versions 10.0 through 11.0

Description The issue is related to a heap-based buffer overflow that allows remote attackers to execute arbitrary code. This can be achieved via a long User-Agent HTTP header in the RTSP service or through unspecified vectors involving the parsing of HTTP URL schemes.

Recommendations For versions 10.0 through 11.0, consider disabling the RTSP service or restricting access to it until a patch is available. Additionally, as a temporary workaround, restrict the length of the User-Agent HTTP header to prevent exploitation.

Fix

Related Identifiers

CVE-2006-3276

Affected Products

Helix Dna Server

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-3276 · Security Note
• http://secunia.com/advisories/20784 · Vendor Advisory
• http://vupen.com/english/advisories/2006/2521 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0600.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27316 · Note
• http://labs.musecurity.com/advisories/MU-200606-01.txt · Note
• http://osvdb.org/26799 · Note
• http://securitytracker.com/id?1016365 · Note
• http://securityfocus.com/bid/18606 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27317 · Note