From: RealForum <[EMAIL PROTECTED]>
Subject: Re: Nasty bug in NT for G2 Server?
Aaron,
Thank you for your question. This exploit has been discovered and is
currently being patched. The exploit only affects the Windows NT version
of RealServer G2 6.0 Gold. It does not affect any Unix servers nor any
RealServer G2 6.1 Beta servers.
Until we have released a patch in the coming days, please refer to the
following knowledge base article for instructions on how to create an
access control list for the administrator port. This will prevent the
exploit from being used.
Adam
Knowledge Base Article:
Is my RealServer susceptible to an exploit on the RealServer Administrator
port?
At installation, RealServer G2 randomly selects an unused port as the
remote administration port. To access this feature, the correct port must
be specified and a valid username/password pair must be entered. By sending
a long response to this authentication request, the buffer can be
overwritten and arbitrary code can be executed on the server.
This problem only exists on the Windows NT platform and does not affect
RealServer G2 6.1 Beta.
RealNetworks will release a patch to prevent this from causing security
problems. Until the patch has been released, please add an Access Control
List (ACL) to RealServer to prevent unwanted users from accessing this
randomly selected port.
To add an ACL to RealServer:
1. Start RealServer and open RealAdministrator.
2. Click Configure, then Setup, and then Ports. Write down the value for
"Admin Port". You may also want to write down the values for the other
ports as well.
3. Click Configure, then Security, and then Access Control.
4. Click "Add An Access Rule."
5. In the Access Rule Name box, type "100" (without the quotes).
6. For the Access value, choose "Allow".
7. In the To box, type "Any" (without the quotes).
8. In the From box, enter your local IP address, followed by
":255.255.255.255".
For example, if the your IP address 192.17.8.92, enter
"192.17.8.92:255.255.255.255".
9. In the Restricted Ports box, type the value for the Admin Port which you
determined in step 2.
10. Click Add.
11. Click Apply.
12. Click Restart Server at the top of the page.
Once you have returned to the Administrator interface, you must grant
access to the other ports from other IP addresses.
For example, you may want to create a new rule with the following properties:
Name: 200
Access: Allow
To: Any
From: Any
Restricted Ports: 554, 7070, 8080
We expect to have a patch available on the RealNetworks Technical Support
site at http://service.real.com
---------------------------------------------
RealForum wrote:
--------------------------------------------
From: "Aaron Bishop" <[EMAIL PROTECTED]>
Subject: Nasty bug in NT for G2 Server?
> If you run RealServer G2 on NT, you better check out:
>
> http://securityportal.com/list-archive/bugtraq/1999/Nov/0051.html
>
> The jury is still out about whether this applies to Unix versions or not.
Folks, this is a nasty little trick (assuming it's valid, I don't
understand the technology well enough to implement the crack and test it
myself), although the website doesn't describe exactly how to do the hack
very well (which, upon reflection, is probably a very good thing).
Has Real been made aware of this? Real folks on the list are very much
encouraged to pipe up here!
Aaron Bishop
CW Audio Engineer
[EMAIL PROTECTED]
*******************************************************
The RealForum is an email discussion group focused on using RealNetworks
products. The RealForum is a place to post messages about the best methods
for creating content using RealNetworks technologies and the planning and
implementation of streaming-media web sites. Archives of RealForum can
be found at http://realforum.real.com
If you ever want to remove yourself from this mailing list,
you can send mail to <[EMAIL PROTECTED]> with the following
command in the body of your email message:
unsubscribe realforum
or from another account, besides the address you subscribed with:
unsubscribe realforum <[EMAIL PROTECTED]>
