PT-2009-1387 · Realnetworks · Helix Server+1

Published 2009-01-20 · Updated 2011-03-08 · CVE-2008-5911

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RealNetworks Helix Server and Helix Mobile Server versions 11.x through 11.1.7 RealNetworks Helix Server and Helix Mobile Server versions 12.x through 12.0.0

Description The issue allows remote attackers to cause a denial of service or execute arbitrary code. This can be achieved through various means, including crafted RTSP SETUP commands, an NTLM authentication request with malformed base64-encoded data, an RTSP DESCRIBE command, or a DataConvertBuffer request.

Recommendations For versions 11.x through 11.1.7, update to version 11.1.8 or later. For versions 12.x through 12.0.0, update to version 12.0.1 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-5911

Affected Products

Helix Mobile Server

Helix Server

References · 8

• http://docs.real.com/docs/security/SecurityUpdate121508HS.pdf · Vendor Advisory
• http://secunia.com/advisories/33360 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5911 · Security Note
• http://securitytracker.com/id?1021500 · Note
• http://vupen.com/english/advisories/2008/3521 · Note
• http://securitytracker.com/id?1021499 · Note
• http://securitytracker.com/id?1021498 · Note
• http://securitytracker.com/id?1021501 · Note