National Cyber-Alert System

Vulnerability Summary for CVE-2008-5911

Overview

Multiple buffer overflows in RealNetworks Helix Server and Helix Mobile Server 11.x before 11.1.8 and 12.x before 12.0.1 allow remote attackers to (1) cause a denial of service via three crafted RTSP SETUP commands, or execute arbitrary code via (2) an NTLM authentication request with malformed base64-encoded data, (3) an RTSP DESCRIBE command, or (4) a DataConvertBuffer request.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Solution

Per: http://docs.real.com/docs/security/SecurityUpdate121508HS.pdf The Fix: Version 11.1.8 and Version 12.0.1 of the Helix Server and the Helix Mobile Server have been updated to ensure that the above vulnerabilities have been resolved. SOLUTION: The vulnerability is resolved on the following platforms by installing Version 11.1.8 or Version 12.0.1 of the Helix Server and the Helix Mobile Server. This only pertains to supported versions of the platforms listed below. The updated version will be available on your RealNetworks PAM site after 11:59 p.m. PST, on December 15, 2008.}

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: SECTRACK

Name: 1021501

Hyperlink:http://www.securitytracker.com/id?1021501

External Source: SECTRACK

Name: 1021500

Hyperlink:http://www.securitytracker.com/id?1021500

External Source: SECTRACK

Name: 1021499

Hyperlink:http://www.securitytracker.com/id?1021499

External Source: SECTRACK

Name: 1021498

Hyperlink:http://www.securitytracker.com/id?1021498

External Source: VUPEN

Name: ADV-2008-3521

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2008/3521

External Source: SECUNIA

Name: 33360

Type: Advisory

Hyperlink:http://secunia.com/advisories/33360

External Source: CONFIRM

Name: http://docs.real.com/docs/security/SecurityUpdate121508HS.pdf

Type: Advisory

Hyperlink:http://docs.real.com/docs/security/SecurityUpdate121508HS.pdf