From core.lists.bugtraq@CORE-SDI.COM Sun Nov 19 04:01:52 2000 From: "[iso-8859-1] Iván Arce" To: BUGTRAQ@SECURITYFOCUS.COM Date: Thu, 16 Nov 2000 20:24:10 -0300 Subject: [BUGTRAQ] [CORE SDI ADVISORY] RealServer memory contents disclosure [The following text is in the "iso-8859-1" character set] [Your display is set for the "US-ASCII" character set] [Some characters may be displayed incorrectly] CORE SDI http://www.core-sdi.com Report for RealServer memory contents disclosure vulnerability Date Published: November 16th, 2000 Advisory ID: CORE-20001116 Bugtraq ID: 1957 CVE CAN: None currently assigned. Title: RealServer memory contents disclosure vulnerability Class: Failure to handle exceptional conditions Remotely Exploitable: Yes Locally Exploitable: Yes Release Mode: COORDINATED RELEASE Vulnerability Description: A memory contents disclosure vulnerability was found on RealNetworks RealServer which will give out information about the server configuration, runtime memory data and tokens and authentication credentials. This information allows an external attacker to possibly obtain administrative access to the server or to data belonging to other user sessions. Vulnerable Packages/Systems: Real Networks Real Server version 7 and below, all supported platforms Solution/Vendor Information/Workaround: A description of the problem and an updated version of Real Server with a fix for the problem is available at: http://service.real.com/help/faq/security/memory.html Vendor notified on: October 17th, 2000 Credits: This vulnerability was found by Gerardo Richarte and Claudio Castiglia from Core SDI S.A. CORE SDI would like to thank RealNetworks Inc. for their prompt response to the problem. This advisory was drafted with the help of the SecurityFocus.com Vulnerability Help Team. For more information or assistance drafting advisories please mail vulnhelp@securityfocus.com. Other CORE SDI advisories can be found at http://www.core-sdi.com/english/publications.html Technical Description - Exploit/Concept Code: Issuing a request to a RealServer with the following URI: http://targetserver/admin/includes/ (note the ending '/' slash) A response will be ellicited containing random pieces of the server's runtime memory. This generally consists of data from previous sessions and contains information that could be used to obtain unauthorized access to the RealServer administration facilities (cookies sent to other clients, BASE64 encoded usernames and passwords, the random port number where the administration server listens, etc.) DISCLAIMER: The contents of this advisory are copyright (c) 2000 CORE SDI S.A. and may be distributed freely provided that no fee is charged for this distribution and proper credit is given. $Id: RealServer-advisory.txt,v 1.9 2000/11/16 20:44:25 iarce Exp $ --- "Understanding. A cerebral secretion that enables one having it to know a house from a horse by the roof on the house, It's nature and laws have been exhaustively expounded by Locke, who rode a house, and Kant, who lived in a horse." - Ambrose Bierce ==================[ CORE Seguridad de la Informacion S.A. ]========= Iván Arce Presidente PGP Fingerprint: C7A8 ED85 8D7B 9ADC 6836 B25D 207B E78E 2AD1 F65A email : iarce@core-sdi.com http://www.core-sdi.com Florida 141 2do cuerpo Piso 7 C1005AAG Buenos Aires, Argentina. Tel/Fax : +(54-11) 4331-5402 ===================================================================== --- For a personal reply use iarce@core-sdi.com