[Full-disclosure] [MU-200708-01] Helix DNA Server Heap Corruption Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Helix DNA Server Heap Corruption Vulnerability MU-200708-01 August 24, 2007 http://labs.musecurity.com/advisories.html Affected Products/Versions: Helix DNA Server versions 11.x Product Overview: https://helix-server.helixcommunity.org/ The Real Time...

Heap overflow

Heap-based buffer overflow in the RTSP service in Helix DNA Server before 11.1.4 allows remote attackers to execute arbitrary code via an RSTP command containing multiple Require headers...

CVE-2007-4561

Heap-based buffer overflow in the RTSP service in Helix DNA Server before 11.1.4 allows remote attackers to execute arbitrary code via an RSTP command containing multiple Require headers...

CVE-2007-4561

The CVE-2007-4561 issue affects RealNetworks Helix DNA Server/Helix Server where the RTSP service processes crafted RTSP requests with multiple Require headers, triggering a heap-based buffer overflow. This allows remote code execution with the server’s privileges (often SYSTEM). Affected version...

RealNetworks Helix DNA Server RTSP Service Crafted Require Header Remote Overflow

The remote host is running Helix Server or Helix DNA Server, a media streaming server. The version of the Helix server installed on the remote host reportedly contains a heap overflow that is triggered using an RTSP command with multiple 'Require' headers. An unauthenticated, remote attacker can...

[SECURITY] Fedora 7 Update: HelixPlayer-1.0.7-6.fc7

Helix Player is an open-source media player built in the Helix Community for consumers. Built using GTK, it plays open source formats, like Ogg Vorbis and Theora using the powerful Helix DNA Client Media Engine...

CVE-2006-6026

CVE-2006-6026 : RealNetworks Helix Server/Helix Mobile Server (pre-11.1.3) and Helix DNA Server (11.0 and 11.1) suffer a heap-based buffer overflow via a DESCRIBE request containing an invalid LoadTestPassword field. An unauthenticated, remote attacker could crash the server or execute arbitrary ...

CVE-2006-6026

Heap-based buffer overflow in Real Networks Helix Server and Helix Mobile Server before 11.1.3, and Helix DNA Server 11.0 and 11.1, allows remote attackers to cause a denial of service application crash or execute arbitrary code via a DESCRIBE request that contains an invalid LoadTestPassword fie...

DSquare Exploit Pack: D2SEC_REALSERVER3

Name| d2secrealserver3 ---|--- CVE| CVE-2006-3276 Exploit Pack| D2ExploitPack Description| Helix DNA Server 11.1 Heap Overflow Notes|...

CVE-2006-3276

Heap-based buffer overflow in RealNetworks Helix DNA Server 10.0 and 11.0 allows remote attackers to execute arbitrary code via 1 a long User-Agent HTTP header in the RTSP service and 2 unspecified vectors involving the "parsing of HTTP URL schemes"...

CVE-2006-3276

Heap-based buffer overflow in RealNetworks Helix DNA Server 10.0 and 11.0 allows remote attackers to execute arbitrary code via 1 a long User-Agent HTTP header in the RTSP service and 2 unspecified vectors involving the "parsing of HTTP URL schemes"...

CVE-2006-3276

RealNetworks Helix DNA Server 10.0 and 11.0 are affected by a heap-based buffer overflow in the RTSP/HTTP handling (long User-Agent header and parsing of HTTP URL schemes). This allows remote code execution. Affected versions include 10.0 and 11.0; mitigation per connected advisories is to upgrad...

CVE-2005-0577

CVE-2005-0577 affects DNA MKBold-MKItalic up to version 0.06_1. The vulnerability is a format string flaw in the BDF font processing that could allow remote code execution. The OpenVAS and NVD records corroborate the issue; they reference the FreeBSD ports mkbold-mkitalic package as affected. The...

CVE-2004-2737

SQL injection vulnerability in problist.asp in NetSupport DNA HelpDesk 1.01 allows remote attackers to execute arbitrary SQL commands via the where parameter...

netsupportDNA.txt

NetSupport DNA HelpDesk SQL Injection Summary DNA Helpdesk is "a fully web based solution providing detailed recording and tracking of user Help Requests". We found the product to contain at least one exploitable SQL Injection vulnerability that would allow a normal user to at the very least gain...

NetSupport DNA HelpDesk 1.0 Problist Script - SQL Injection

source: https://www.securityfocus.com/bid/10772/info An SQL injection vulnerability is identified in the application that may allow attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks. This vulnerability exists due to insufficient...