From: RealForum <[EMAIL PROTECTED]>
Subject: Re: Nasty bug in NT for G2 Server?
A patch is now available at
http://service.real.com/help/faq/servg260.html Please visit this page for
more information on this problem and download the patch if needed.
Technical questions about how to apply this patch should be directed to our
technical support staff at http://service.real.com
Adam
At 01:55 PM 11/5/99 , RealForum wrote:
>From: RealForum <[EMAIL PROTECTED]>
>Subject: Re: Nasty bug in NT for G2 Server?
>
>Aaron,
>
>Thank you for your question. This exploit has been discovered and is
>currently being patched. The exploit only affects the Windows NT version
>of RealServer G2 6.0 Gold. It does not affect any Unix servers nor any
>RealServer G2 6.1 Beta servers.
>
>Until we have released a patch in the coming days, please refer to the
>following knowledge base article for instructions on how to create an
>access control list for the administrator port. This will prevent the
>exploit from being used.
>
>Adam
>
>Knowledge Base Article:
>Is my RealServer susceptible to an exploit on the RealServer Administrator
>port?
>
>At installation, RealServer G2 randomly selects an unused port as the
>remote administration port. To access this feature, the correct port must
>be specified and a valid username/password pair must be entered. By sending
>a long response to this authentication request, the buffer can be
>overwritten and arbitrary code can be executed on the server.
>
>This problem only exists on the Windows NT platform and does not affect
>RealServer G2 6.1 Beta.
>
>RealNetworks will release a patch to prevent this from causing security
>problems. Until the patch has been released, please add an Access Control
>List (ACL) to RealServer to prevent unwanted users from accessing this
>randomly selected port.
>
>To add an ACL to RealServer:
>
>1. Start RealServer and open RealAdministrator.
>
>2. Click Configure, then Setup, and then Ports. Write down the value for
>"Admin Port". You may also want to write down the values for the other
>ports as well.
>
>3. Click Configure, then Security, and then Access Control.
>
>4. Click "Add An Access Rule."
>
>5. In the Access Rule Name box, type "100" (without the quotes).
>
>6. For the Access value, choose "Allow".
>
>7. In the To box, type "Any" (without the quotes).
>
>8. In the From box, enter your local IP address, followed by
>":255.255.255.255".
>
>For example, if the your IP address 192.17.8.92, enter
>"192.17.8.92:255.255.255.255".
>
>9. In the Restricted Ports box, type the value for the Admin Port which you
>determined in step 2.
>
>10. Click Add.
>
>11. Click Apply.
>
>12. Click Restart Server at the top of the page.
>
>Once you have returned to the Administrator interface, you must grant
>access to the other ports from other IP addresses.
>
>For example, you may want to create a new rule with the following properties:
>
> Name: 200
> Access: Allow
> To: Any
> From: Any
> Restricted Ports: 554, 7070, 8080
>
>We expect to have a patch available on the RealNetworks Technical Support
>site at http://service.real.com
>
>
>
>---------------------------------------------
>RealForum wrote:
>--------------------------------------------
>From: "Aaron Bishop" <[EMAIL PROTECTED]>
>Subject: Nasty bug in NT for G2 Server?
>
> > If you run RealServer G2 on NT, you better check out:
> >
> > http://securityportal.com/list-archive/bugtraq/1999/Nov/0051.html
> >
> > The jury is still out about whether this applies to Unix versions or not.
>
>Folks, this is a nasty little trick (assuming it's valid, I don't
>understand the technology well enough to implement the crack and test it
>myself), although the website doesn't describe exactly how to do the hack
>very well (which, upon reflection, is probably a very good thing).
>
>Has Real been made aware of this? Real folks on the list are very much
>encouraged to pipe up here!
>
>Aaron Bishop
>CW Audio Engineer
>[EMAIL PROTECTED]
*******************************************************
The RealForum is an email discussion group focused on using RealNetworks
products. The RealForum is a place to post messages about the best methods
for creating content using RealNetworks technologies and the planning and
implementation of streaming-media web sites. Archives of RealForum can
be found at http://realforum.real.com
If you ever want to remove yourself from this mailing list,
you can send mail to <[EMAIL PROTECTED]> with the following
command in the body of your email message:
unsubscribe realforum
or from another account, besides the address you subscribed with:
unsubscribe realforum <[EMAIL PROTECTED]>
