Signature Detail

APP: RealNetworks Helix Server NTLM Authentication Heap Overflow

This signature detects attempts to exploit a known heap-based buffer overflow vulnerability in RealNetworks Helix Server products. It is due to an error when handling Base64-encoded NTLM Authentication data. A remote unauthenticated attacker can exploit this by sending a maliciously crafted request to the target server. A successful attack can allow for arbitrary code injection and execution with the privileges of the server process. Code injection that does not result in execution could terminate the application due to memory corruption and cam result in a denial-of-service condition.

Extended Description

RealNetworks Helix Server and Helix Mobile Server are prone to a remote heap-based buffer-overflow vulnerability during NTLM authentication. Exploiting this issue may allow attackers to gain unauthorized access to affected computers. Failed attempts may cause the affected application to crash, denying service to legitimate users. This issue affects versions prior to Helix Server and Helix Mobile Server 14.0. NOTE: This BID was formerly titled 'RealNetworks Helix and Helix Mobile Server Multiple Remote Code Execution Vulnerabilities' and covered three vulnerabilities; the two AgentX issues have received their own records (39561 AgentX++ 'AgentX::receive_agentx()' Remote Code Execution Vulnerability and 39564 AgentX++ 'AgentX::receive_agentx()' Remote Stack Buffer Overflow Vulnerability) to better document them.

Affected Products

• Real_networks helix_mobile_server 11.1.2
• Real_networks helix_mobile_server 11.1.4
• Real_networks helix_mobile_server 11.1.6
• Real_networks helix_mobile_server 11.1.7
• Real_networks helix_mobile_server 11.1.8
• Real_networks helix_mobile_server 12.0.0
• Real_networks helix_mobile_server 12.0.1
• Real_networks helix_mobile_server 12.0.1 .215
• Real_networks helix_mobile_server 13.0.0
• Real_networks helix_server 11.1.2
• Real_networks helix_server 11.1.4
• Real_networks helix_server 11.1.6
• Real_networks helix_server 11.1.7
• Real_networks helix_server 11.1.8
• Real_networks helix_server 12.0.0
• Real_networks helix_server 12.0.1
• Real_networks helix_server 12.0.1 .215
• Real_networks helix_server 13.0.0

References

• BugTraq: 39490
• CVE: CVE-2010-1317