search menu icon-carat-right cmu-wordmark

CERT Coordination Center


RealNetworks Helix Universal Server vulnerable to buffer overflow when sent two simultaneous HTTP requests containing a long string of characters

Vulnerability Note VU#974689

Original Release Date: 2003-04-17 | Last Revised: 2003-04-17

Overview

The RealNetworks' Helix Universal Server supports delivery of several different media types over the Internet. Vulnerabilities have been discovered in the way it handles some requests from the network. These vulnerabilities could allow a remote attacker to execute arbitrary code on vulnerable systems.

Description

Researchers at NGSSoftware have discovered a vulnerability in the way that the Helix Universal Server handles HTTP GET requests for overly long URIs. According to the NGSSoftware advisory:

"By making two HTTP requests (port 80) containing long URI's simultaneously, (in making the first connection, it will appear to hang, by keeping this session open and making another connection and supplying the same request again ), will cause the saved return address to also be overwritten, allowing an attacker to run arbitrary code of their choosing."

This vulnerability is similar to VU#329561 and VU#485057, which were also discovered by NGSSoftware and published in the same advisory.

Impact

A remote attacker may be able to execute arbitrary code on the vulnerable system. This attacker-supplied code would be run with the privileges of the user running the Helix Server.

Solution

Apply a patch from the vendor

RealNetworks has provided information about patches for the Helix Universal Server at the following location:

http://www.service.real.com/help/faq/security/bufferoverrun12192002.html

Users are encouraged to review this information and apply the patch.


Workarounds

Disable access to the Helix Server via HTTP

If patches cannot be applied, limit access to the HTTP service (80/tcp) on the vulnerable systems to trusted systems on the network. Note that this will not prevent internal attackers from exploiting this vulnerability, but can limit exposure. As a general rule, the CERT/CC recommends blocking access to all services that are not explicitly required.

Vendor Information

974689
Expand all

RealNetworks

Updated:  April 02, 2003

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Apply a patch from the vendor

RealNetworks has provided information about patches for the Helix Universal Server at the following location:

http://www.service.real.com/help/faq/security/bufferoverrun12192002.html

Users are encouraged to review this information and apply the patch.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

Thanks to Mark Litchfield of NGSSoftware Insight Security Research for reporting this vulnerability.

This document was written by Chad R Dougherty.

Other Information

CVE IDs: None
Severity Metric: 8.55
Date Public: 2002-12-20
Date First Published: 2003-04-17
Date Last Updated: 2003-04-17 18:04 UTC
Document Revision: 12

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.