RealNetworks Helix Server 12.x Multiple DoS

2009-07-2100:00:00

Tenable

www.tenable.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS

0.882

Percentile

98.7%

JSON

According to its banner, the remote host is running version 12.x of RealNetworks Helix Server / Helix Mobile Server. Such versions are reportedly affected by multiple issues :

By sending a specially crafted ‘RTSP’ (SET_PARAMETERS) request with ‘DataConvertBuffer’ parameter set to empty, an attacker may be able to crash the remote Helix server process. (CVE-2009-2533)
By sending a ‘SETUP’ request without including a ‘/’ character in it, a remote attacker may be able to crash the remote Helix server process. (CVE-2009-2534)