RTSP: Real Server Describe Overflow

This signature detects attempts to exploit a known vulnerability against Real Networks Real Server. Windows and Linux versions of Real Server are vulnerable. Attackers can send an abnormally long RTSP DESCRIBE request to cause a server overflow and possibly execute arbitrary code.

Extended Description

Helix Universal Server is a multiple type media server distributed and maintained by RealNetworks. It is available for Unix, Linux, and Microsoft Windows platforms. A buffer overflow has been reported in the Helix Universal Server. Due to insufficient bounds checking on the 'describe' field of a RTSP request, it is possible for a user to exploit a boundry condition error. This could lead to the remote execution of arbitrary code with the privileges of the Helix Universal Server process.

Affected Products

Real_networks helix_universal_server

References

BugTraq: 6456

CVE: CVE-2002-1643

URL: http://www.service.real.com/help/faq/security/bufferoverrun12192002.html http://www.securityfocus.com/archive/1/304203 http://www.kb.cert.org/vuls/id/485057

Short Name

RTSP:OVERFLOW:DESCRIBE-OF

Severity

Major

Recommended

False

Recommended Action

Drop

RTSP: Real Server Describe Overflow

Extended Description

Affected Products

References

Found a potential security threat?