# MA-059.112003: MyCERT Advisory - Real Networks Helix Universal Server 9 Vulnerability

**Date:** 10 Nov 2003  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-059.112003  
**Advisory ID:** MA-059.112003

---

MyCERT received many reports regarding active scannings to port TCP/554 (Real Time Streaming Protocol). From our analysis and findings we believe these are scannings to identify identify vulnerabilities that may present in Real Networks Helix Universal server 9.
RealNetworks Helix Universal Server 9 and earlier versions, Real System Server 8,7 and Real Server G2 are vulnerable to a root exploit when certain types of character strings appear in large numbers within URLs destined for the Server's protocol parsers.However, RealNetworks Proxy products are not vulnerable to this exploit.
This vulnerability is discussed extensively in the following sites:
> RealNetworks media server RTSP protocol parser buffer overflow
> http://www.kb.cert.org/vuls/id/934932
>
> Multiple Buffer overruns RealNetworks Helix Universal Server
> http://www.securiteam.com/securitynews/6E00T1F6AY.html
>
> Potential Buffer Overrun Vulnerabilities in Helix Universal Server 9.0
> http://www.service.real.com/help/faq/security/bufferoverrun12192002.html
MyCERT would like to alert and advise all System Administrators and IT personnel to patch or upgrade their Real networks Helix Universal Server 9 and below to prevent it from being compromised.
You may refer to the following URL for support and patches for Real Networks Helix Universal Server at:
Support and Patch
http://www.realnetworks.com/resources/contentdelivery/server/recommended\_platforms.html