Some vulnerabilities have been reported in RealNetworks Helix Server, which can be exploited by malicious people to cause a DoS (Denial of Service) or to compromise a vulnerable system.

1) An unspecified error in the processing of RTSP DESCRIBE commands can be exploited to cause a heap-based buffer overflow.

Successful exploitation allows execution of arbitrary code.

2) An unspecified error when parsing RTSP SETUP commands can be exploited to cause stack-based buffer overflow via three consequent, specially crafted requests to port 554 of an affected server.

3) An unspecified error in "DataConvertBuffer" can be exploited to cause a heap-based buffer overflow and allows execution of arbitrary code.

4) An unspecified error in the processing of Base64-encoded data in "NTLM Authentication" can be exploited to cause a heap-based buffer overflow and allows execution of arbitrary code.

The vulnerabilities have been reported in Helix Server version 11.x and 12.x and Helix Mobile Server Version 11.x and 12.x.

Solution
Update to version 11.1.8 or version 12.0.1.

Provided and/or discovered by
The vendor credits TippingPoint and Noam Rathaus.

Changelog
Further details available to Secunia VIM customers

Original Advisory
RealNetworks:
http://docs.real.com/docs/security/SecurityUpdate121508HS.pdf

Deep Links
Links available to Secunia VIM customers