Some vulnerabilities have been reported in Helix Server and Helix Mobile Server, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

1) A boundary error within the NTLM authentication in the administrative web interface can be exploited to cause a heap-based buffer overflow via a specially crafted Base64 string in the "Authorization" header.

Successful exploitation may allow execution of arbitrary code.

2) A boundary error in AgentX++ can be exploited to cause a stack-based buffer overflow and potentially execute arbitrary code.

3) An integer overflow error in AgentX++ can be exploited to cause a heap-based buffer overflow and potentially execute arbitrary code.

Vulnerabilities #2 and #3 are related to:
SA39489

Solution
Upgrade to version 14.0.0, which fixes the vulnerabilities.

Provided and/or discovered by
1) An anonymous person, reported via ZDI.
2) Manuel Santamarina Suarez, reported via iDefense
3) Joshua J. Drake of iDefense Labs

Changelog
Further details available to Secunia VIM customers

Original Advisory
RealNetworks:
http://www.realnetworks.com/uploadedFiles/Support/helix-support/SecurityUpdate041410HS.pdf

iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=867
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=868

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-10-079/

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers