{"vuid":"VU#329561","idnumber":"329561","name":"RealNetworks Helix Universal Server vulnerable to buffer overflow when supplied an overly long string within the \"Transport\" field of a SETUP RTSP request","keywords":["RealNetworks","Helix Universal Server","buffer overflow","long string of characters","Transport field","SETUP RTSP request","NISR20122002"],"overview":"The RealNetworks' Helix Universal Server supports delivery of several different media types via RTSP (Real Time Streaming Protocol). Vulnerabilities have been discovered in the way it handles some RTSP requests. These vulnerabilities could allow a remote attacker to execute arbitrary code on vulnerable systems.","clean_desc":"Researchers at NGSSoftware have discovered a vulnerability in the way that the Helix Universal Server overly long strings in the Transport field of an RTSP SETUP request. According to the NGSSoftware advisory: \"By supplying an overly long character string within the Transport field of a SETUP RTSP request to a Helix server, which by default listens on TCP port 554, an overflow will occur overwriting the saved return address on the stack. On a windows box, the Helix server is installed by default as a system service and so exploitation of this vulnerability would result in a complete server compromise, with supplied code executing in the security context of SYSTEM. The impact of these vulnerabilities on UNIX based platforms was not tested, though they are vulnerable.\" This vulnerability is similar to VU#485057 and VU#974689, which were also discovered by NGSSoftware and published in the same advisory.","impact":"A remote attacker may be able to execute arbitrary code on the vulnerable system. This attacker-supplied code would be run with the privileges of the user running the Helix Server.","resolution":"Apply a patch from the vendor RealNetworks has provided information about patches for the Helix Universal Server at the following location: http://www.service.real.com/help/faq/security/bufferoverrun12192002.html Users are encouraged to review this information and apply the patch.","workarounds":"Workarounds Disable access to the Helix Server via RTSP If patches cannot be applied, limit access to the RTSP service (554/tcp) on the vulnerable systems to trusted systems on the network. Note that this will not prevent internal attackers from exploiting this vulnerability, but can limit exposure. As a general rule, the CERT/CC recommends blocking access to all services that are not explicitly required.","sysaffected":"","thanks":"Thanks to Mark Litchfield of \nNGSSoftware Insight Security Research\n for reporting this vulnerability.","author":"This document was written by Chad R Dougherty.","public":["http://www.real.com/","http://www.service.real.com/help/faq/security/bufferoverrun12192002.html","http://www.nextgenss.com/advisories/realhelix.txt","http://www.ietf.org/rfc/rfc2326.txt"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2002-12-20T20:52:49Z","publicdate":"2002-12-20T00:00:00Z","datefirstpublished":"2003-04-17T14:20:48Z","dateupdated":"2003-04-17T18:03:12Z","revision":18,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"5","cam_population":"6","cam_impact":"19","cam_easeofexploitation":"10","cam_attackeraccessrequired":"15","cam_scorecurrent":"6.4125","cam_scorecurrentwidelyknown":"8.015625","cam_scorecurrentwidelyknownexploited":"14.428125","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":6.4125,"vulnote":null}