Vulnerability Note VU#485057

RealNetworks Helix Universal Server vulnerable to buffer overflow when supplied an overly long string for the "Describe" field

Overview

The RealNetworks' Helix Universal Server supports delivery of several different media types over the Internet via RTSP (Real Time Streaming Protocol). Vulnerabilities have been discovered in the way it handles some RTSP requests. These vulnerabilities could allow a remote attacker to execute arbitrary code on vulnerable systems.

I. Description

Researchers at NGSSoftware have discovered a vulnerability in the way that the Helix Universal Server handles RTSP DESCRIBE requests for overly long URIs. According to the NGSSoftware advisory:

By supplying a very long URL in the Describe field, again over port 554, an attacker can overwrite the saved return address allowing the execution of code.

This vulnerability is similar to VU#329561 and VU#974689, which were also discovered by NGSSoftware and published in the same advisory.

II. Impact

A remote attacker may be able to execute arbitrary code on the vulnerable system. This attacker-supplied code would be run with the privileges of the user running the Helix Server.

III. Solution

Apply a patch from the vendor

RealNetworks has provided information about patches for the Helix Universal Server at the following location:

http://www.service.real.com/help/faq/security/bufferoverrun12192002.html

Users are encouraged to review this information and apply the patch.
Workarounds

Disable access to the Helix Server via RTSP

If patches cannot be applied, limit access to the RTSP service (554/tcp) on the vulnerable systems to trusted systems on the network. Note that this will not prevent internal attackers from exploiting this vulnerability, but can limit exposure. As a general rule, the CERT/CC recommends blocking access to all services that are not explicitly required.

Systems Affected

Vendor	Status	Date Notified	Date Updated
RealNetworks	Vulnerable	2-Apr-2003

References

http://www.real.com/
http://www.service.real.com/help/faq/security/bufferoverrun12192002.html
http://www.nextgenss.com/advisories/realhelix.txt
http://www.ietf.org/rfc/rfc2326.txt

Credit

Thanks to Mark Litchfield of NGSSoftware Insight Security Research for reporting this vulnerability.

This document was written by Chad R Dougherty.

Other Information

Date Public:	2002-12-20
Date First Published:	2003-04-17
Date Last Updated:	2003-04-17
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	6.41
Document Revision:	14

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader