NVD Vulnerability Detail

CVE-2008-5911

Summary	Multiple buffer overflows in RealNetworks Helix Server and Helix Mobile Server 11.x before 11.1.8 and 12.x before 12.0.1 allow remote attackers to (1) cause a denial of service via three crafted RTSP SETUP commands, or execute arbitrary code via (2) an NTLM authentication request with malformed base64-encoded data, (3) an RTSP DESCRIBE command, or (4) a DataConvertBuffer request.
Summary	Per: http://docs.real.com/docs/security/SecurityUpdate121508HS.pdf Impacted Products and Versions: Helix Server Version 11.x Helix Server Version 12.x Helix Mobile Server Version 11.x Helix Mobile Server Version 12.x
Summary	Per: http://docs.real.com/docs/security/SecurityUpdate121508HS.pdf The Fix: Version 11.1.8 and Version 12.0.1 of the Helix Server and the Helix Mobile Server have been updated to ensure that the above vulnerabilities have been resolved. SOLUTION: The vulnerability is resolved on the following platforms by installing Version 11.1.8 or Version 12.0.1 of the Helix Server and the Helix Mobile Server. This only pertains to supported versions of the platforms listed below. The updated version will be available on your RealNetworks PAM site after 11:59 p.m. PST, on December 15, 2008.
Publication Date	Jan. 21, 2009, 1 a.m.
Registration Date	Jan. 29, 2021, 1:48 p.m.
Last Update	March 8, 2011, 12:15 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:realnetworks:helix_server:11.0:::::::*
cpe:2.3:a:realnetworks:helix_server:12.0.0:::::::*
cpe:2.3:a:realnetworks:helix_server_mobile:11.0:::::::*
cpe:2.3:a:realnetworks:helix_server_mobile:12.0.0:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://docs.real.com/docs/security/SecurityUpdate121508HS.pdf	CONFIRM	Vendor Advisory
2	http://secunia.com/advisories/33360	SECUNIA	Vendor Advisory
3	http://www.securitytracker.com/id?1021498	SECTRACK
4	http://www.securitytracker.com/id?1021499	SECTRACK
5	http://www.securitytracker.com/id?1021500	SECTRACK
6	http://www.securitytracker.com/id?1021501	SECTRACK
7	http://www.vupen.com/english/advisories/2008/3521	VUPEN

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

RealNetworks Helix Server などにおけるバッファオーバーフローの脆弱性

Title	RealNetworks Helix Server などにおけるバッファオーバーフローの脆弱性
Summary	RealNetworks Helix Server および Helix Mobile Server には、バッファオーバーフローの脆弱性が存在します。
Possible impacts	第三者により、以下の可能性があります。 (1) 3 つの巧妙に細工された RTSP SETUP コマンドを介して、サービス運用妨害 (DoS) 状態にされる可能性 (2) 不正な形式の base64 でエンコードされたデータを伴う NTLM 認証リクエストを介して、任意のコードを実行される可能性 (3) RTSP DESCRIBE コマンドを介して、任意のコードを実行される可能性 (4) DataConvertBuffer リクエストを介して、任意のコードを実行される可能性
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 16, 2008, midnight
Registration Date	Dec. 20, 2012, 7:10 p.m.
Last Update	Dec. 20, 2012, 7:10 p.m.

Affected System

リアルネットワークス

helix server mobile 11.1.8 未満の 11.x および 12.0.1 未満の 12.x

RealNetworks Helix Server

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2008-5911	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5911
National Vulnerability Database (NVD)
2	CVE-2008-5911	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5911

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
realnetworks
1	SecurityUpdate121508HS	http://docs.real.com/docs/security/SecurityUpdate121508HS.pdf

Change Log

No	Changed Details	Date of change
0	[2012年12月20日] 掲載	Feb. 17, 2018, 10:37 a.m.