CVE-2008-5911 Memory corruption in n/a

Critical 10.0 Published 20 Jan 2009 Updated 7 Aug 2024

Remote attackers can execute arbitrary code or cause denial of service in RealNetworks Helix Server via crafted RTSP or authentication requests.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2008-5911?

CVE-2008-5911 is a critical memory corruption vulnerability in n/a, published on 20 Jan 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multiple buffer overflows in RealNetworks Helix Server and Helix Mobile Server 11.x before 11.1.8 and 12.x before 12.0.1 allow remote attackers to (1) cause a denial of service via three crafted RTSP SETUP commands, or execute arbitrary code via (2) an NTLM authentication request with malformed base64-encoded data, (3) an RTSP DESCRIBE command, or (4) a DataConvertBuffer request.

Weakness: CWE-119

Which versions are affected by CVE-2008-5911?

It affects 2 products.

Products include Realnetworks Helix Server, Realnetworks Helix Server Mobile.

How do I fix CVE-2008-5911?

No fix has been published for CVE-2008-5911 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2008-5911 being exploited?

There is no known exploitation of CVE-2008-5911 in the wild and no public exploit code.

Sources

Also known as GHSA-gfhg-4w55-8q3g.