Detections
Analytics
RealNetworks Helix Server 14.x < 14.3.x Multiple Vulnerabilities
critical Nessus Plugin ID 58724
Language:
Synopsis
The remote media streaming server is affected by multiple vulnerabilities.Description
According to its banner, the remote host is running version 14.x of RealNetworks Helix Server / Helix Mobile Server. Such versions are potentially affected by multiple vulnerabilities :- Administrative and user credentials are insecurely stored in a flat file database. This file may be accessed by local users to disclose passwords stored in plaintext. (CVE-2012-1923)
- A buffer overflow exists in the code that parses authentication credentials. It may be possible for a remote attacker to exploit this issue and execute arbitrary code. (CVE-2012-0942)
- Multiple unspecified cross-site scripting vulnerabilities. (CVE-2012-1984)
- A specially crafted malformed URL can cause the server process to crash if opened by an administrator. (CVE-2012-1985)
- Establishing and immediately closing a TCP connection on port 705 can cause the SNMP Master Agent to crash.
(CVE-2012-2267)
- A specially crafted Open-PDU request sent to the SNMP Master Agent can cause it to crash due to an unhandled exception. (CVE-2012-2268)
Solution
Upgrade to RealNetworks Helix Server / Helix Mobile Server 14.3.x or later.See Also
https://secuniaresearch.flexerasoftware.com/secunia_research/2012-8/
https://secuniaresearch.flexerasoftware.com/secunia_research/2012-9/
https://www.securityfocus.com/archive/1/522249/30/0/threaded
https://www.securityfocus.com/archive/1/522250/30/0/threaded
http://helixproducts.real.com/docs/security/SecurityUpdate04022012HS.pdf
Plugin Details
Severity: Critical
ID: 58724
File Name: helix_svr_14_3_multiple.nasl
Version: 1.9
Type: remote
Family: Misc.
Published: 4/12/2012
Updated: 11/15/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:realnetworks:helix_server
Exploit Ease: No known exploits are available
Patch Publication Date: 4/2/2012
Vulnerability Publication Date: 4/9/2012
Reference Information
CVE: CVE-2012-0942, CVE-2012-1923, CVE-2012-1984, CVE-2012-1985, CVE-2012-2267, CVE-2012-2268
BID: 52929