TippingPoint Zero Day Initiative
 

RealNetworks Helix Server DataConvertBuffer Heap Overflow Vulnerability

ZDI-08-090: December 16th, 2008

CVE ID

Affected Vendors

Affected Products

TippingPoint™ IPS Customer Protection

TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 5863. For further product information on the TippingPoint IPS:

Vulnerability Details

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of RealNetworks Helix Server. Authentication is not required to exploit this vulnerability.

The specific flaw exists while processing malformed base64 encoded data from a SET_PARAMETER command containing the DataConvertBuffer header within an RTSP packet. The service fails to check that the data was properly decoded. The process then uses a faulty return value as a size parameter leading to an exploitable heap based buffer overflow. Exploitation of this vulnerability allows an attacker to execute arbitrary code under the context of the SYSTEM user.

Vendor Response

Disclosure Timeline

    2008-05-13 - Vulnerability reported to vendor
    2008-12-16 - Coordinated public release of advisory

Credit

This vulnerability was discovered by:
    Anonymous