Denial of Dervice vulnerability in Helix Mobile Server- (RealNetworks) (14.0.0.348) with long string to PluginDirectory in- rmserver.cfg file

From: praveen_recker@sify.com
To: bugtraq@securityfocus.com
Cc:
Subject: Denial of Dervice vulnerability in Helix Mobile Server- (RealNetworks) (14.0.0.348) with long string to PluginDirectory in- rmserver.cfg file
Date:


Reproducing the Issue:
In configuration file rmserver.cfg located at C:\Program Files\Real\Helix Server give below string as path
<Var PluginDirectory="A * 5000"/>

Versioning information of Softwares:
Microsoft XP Professional SP2 with Helix Mobile Server (RealNetworks) (14.0.0.348) (Build 211367/15270) Trial.

With the mailicious config when we open the server by double clicking rmserver.exe at C:\Program Files\Real\Helix Server\Bin
                              or
Start -> Programs -> Helix Mobile Server -> Helix Mobile Server

rmserver.exe process CPU usage will shoot upto 90+ percentage and remains there !!!





Copyright © 1995-2018 LinuxRocket.net. All rights reserved.