[ advisories | exploits | discussions | news | conventions | security tools | texts & papers ]
 main menu
- feedback
- advertising
- privacy
- FightAIDS
- newsletter
- news
- read forum
- new topic
- search

- meetings list
- recent additions
- add your info
 top 100 sites
- visit top sites
- sign up now
- members

- add your url
- add domain
- search box
- link to us

- our projects
- free email
 m4d network
- security software
- secureroot
- m4d.com
Home : Advisories : Report for RealServer memory contents disclosure vulnerability

Title: Report for RealServer memory contents disclosure vulnerability
Released by: CORE SDI
Date: 16th November 2000
Printable version: Click here
                                              CORE SDI


            Report for RealServer memory contents disclosure vulnerability

Date Published: November 16th, 2000

Advisory ID: CORE-20001116

Bugtraq ID: 1957

CVE CAN: None currently assigned.

Title: RealServer memory contents disclosure vulnerability

Class: Failure to handle exceptional conditions

Remotely Exploitable: Yes

Locally Exploitable: Yes


Vulnerability Description:

  A memory contents disclosure vulnerability was found on RealNetworks

  RealServer which will give out information about the server configuration,

  runtime memory data and tokens and authentication credentials.

  This information allows an external attacker to possibly obtain

  administrative access to the server or to data belonging to other user


Vulnerable Packages/Systems:

  Real Networks Real Server version 7 and below, all supported platforms

Solution/Vendor Information/Workaround:

  A description of the problem and an updated version of

  Real Server with a fix for the problem is available at:


Vendor notified on: October 17th, 2000


  This vulnerability was found by Gerardo Richarte and Claudio Castiglia

  from Core SDI S.A.

  CORE SDI would like to thank RealNetworks Inc. for their prompt

  response to the problem.

  This advisory was drafted with the help of the SecurityFocus.com

  Vulnerability Help Team. For more information or assistance drafting

  advisories please mail vulnhelp@securityfocus.com.

  Other CORE SDI advisories can be found at


Technical Description - Exploit/Concept Code:

  Issuing a request to a RealServer with the following URI:

  http://targetserver/admin/includes/   (note the ending '/' slash)

  A response will be ellicited containing random pieces of

  the server's runtime memory. This generally consists of

  data from previous sessions and contains information that

  could be used to obtain unauthorized access to the RealServer

  administration facilities (cookies sent to other clients,

  BASE64 encoded usernames and passwords, the random port  number

  where the administration server listens, etc.)


  The contents of this advisory are copyright (c) 2000 CORE SDI S.A.

  and may be distributed freely provided that no fee is charged for this

  distribution and proper credit is given.

$Id: RealServer-advisory.txt,v 1.9 2000/11/16 20:44:25 iarce Exp $


"Understanding. A cerebral secretion that enables one having it to know

 a house from a horse by the roof on the house,

 It's nature and laws have been exhaustively expounded by Locke,

 who rode a house, and Kant, who lived in a horse." - Ambrose Bierce

==================[ CORE Seguridad de la Informacion S.A. ]=========

Iván Arce


PGP Fingerprint: C7A8 ED85 8D7B 9ADC 6836  B25D 207B E78E 2AD1 F65A

email   : iarce@core-sdi.com


Florida 141 2do cuerpo Piso 7

C1005AAG Buenos Aires, Argentina.

Tel/Fax : +(54-11) 4331-5402


--- For a personal reply use iarce@core-sdi.com

(C) 1999-2000 All rights reserved.