VULNERABILITIES / FIXES - April 09, 2012
by Carol~ - 4/9/12 8:30 AM
RealNetworks Helix Server Multiple Vulnerabilities
Release Date : 2012-04-09
Criticality level : Highly critical
Impact : Cross Site Scripting
Exposure of sensitive information
Where : From remote
Solution Status : Vendor Patch
Software: Helix Mobile Server 14.x
Helix Server 14.x
Multiple vulnerabilities have been reported in RealNetworks Helix Server, which can be exploited by malicious, local users to disclose sensitive information and by malicious people to conduct cross-site scripting attacks, cause a DoS (Denial of Service), or compromise a vulnerable system.
1) The administrative and user credentials are insecurely stored in the flat file database (\Program Files\Real\Helix Server\adm_b_db\users\), which can be exploited by local users to disclose the clear text passwords.
2) An error in the SNMP Master Agent process (master.exe) can be exploited to terminate the service by establishing and immediately closing a TCP connection on port 705.
3) An input validation error when processing the "DisplayString" of SNMP object idenfiers can be exploited to cause an unhandled exception and terminate the SNMP Master Agent service (master.exe) via a specially crafted "Open-PDU" request sent to TCP port 705.
4) An unspecified error during rn5auth credential parsing can be exploited to cause a buffer overflow.
Successful exploitation of this vulnerability may allow execution of arbitrary code.
5) Certain unspecified input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
6) An error when handling certain malformed URLs can be exploited to crash the server process, but requires conducting a successful CSRF (cross-site request forgery) attack against an administrative user.
The vulnerabilities are reported in version 126.96.36.199. Other versions may also be affected.
Update to version 14.3.x.
Provided and/or discovered by:
1-3) Dmitriy Pletnev, Secunia Research.
5, 6) The vendor credits Tom Gallagher, Microsoft Vulnerability Research (MSVR).
The vendor also credits Derek Brown via ZDI.