Helix Universal Server and RealServer URL Parsing Flaw in View Source Plug-in Lets Remote Users Execute Arbitrary Code With Root Privileges
|
|
SecurityTracker Alert ID: 1007558
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Aug 23 2003
|
Impact: Execution of arbitrary code via network, Root access via network
|
Vendor Confirmed: Yes
|
Version(s): 9 and prior versions (including RealSystem Server 8, 7 and RealServer G2)
|
Description: A vulnerability was reported in the RealNetworks Helix Universal Server version 9 and prior versions. A remote user can execute arbitrary code with root privileges.
It is reported that a remote user can request a URL containing large numbers of certain character strings to cause the server to
execute arbitrary code. The flaw reportedly resides in the protocol parsers.
According to the vendor, the RealNetworks Proxy
products are not affected.
|
Impact: A remote user can execute arbitrary code with root privileges.
|
Solution: As a workaround, the vulnerability can reportedly be mitigated by removing the RealNetworks View Source plug-in from the /Plugins
directory and then restarting the Server process:
vsrcplin.so (UNIX)
vsrcplin.dll (Windows)
With the plug-in removed, the
Content Browsing feature will be disabled but streaming delivery and logging and authentication services will not be affected.
The
vendor is working on a fix for the Helix Universal Server.
|
Vendor URL: www.service.real.com/help/faq/security/rootexploit082203.html (Links to External Site)
|
Cause: Not specified
|
Underlying OS: Linux (Any), UNIX (AIX), UNIX (FreeBSD), UNIX (HP/UX), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (NT), Windows (2000), Windows (XP)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Fri, 22 Aug 2003 17:47:44 -0400
Subject: http://www.service.real.com/help/faq/security/rootexploit082203.html
|
Helix Universal Server and RealServer URL Parsing Flaw in "View Source" Plug-in Lets
Remote Users Execute Arbitrary Code With Root Privileges
RealNetworks announced a vulnerability in the Helix Universal Server 9 and earlier
versions (RealSystem Server 8, 7 and RealServer G2). A remote user can request a URL
containing large numbers of certain character strings to cause the server to execute
arbitrary code. The flaw reportedly resides in the protocol parsers.
According to the vendor, the RealNetworks Proxy products are not affected.
As a workaround, the vulnerability can reportedly be mitigated by removing the
RealNetworks View Source plug-in from the /Plugins directory and then restarting the
Server process:
vsrcplin.so (UNIX)
vsrcplin.dll (Windows)
With the plug-in removed, the Content Browsing feature will be disabled but streaming
delivery and logging and authentication services will not be affected..
The vendor is working on a fix for the Helix Universal Server.
|
|
