High severity · published Jun 1, 2004
CVE-2004-0389
RealNetworks Helix Universal Server 9.0.1 and 9.0.2 allows remote attackers to cause a denial of service (crash) via malformed requests that trigger a null dereference, as…
7.5
CVSS
54.9%
EPSS
No
On KEV
Description
RealNetworks Helix Universal Server 9.0.1 and 9.0.2 allows remote attackers to cause a denial of service (crash) via malformed requests that trigger a null dereference, as demonstrated using (1) GET_PARAMETER or (2) DESCRIBE requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)54.9% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HU
Helix Universal Server · Realnetworks
9.0.1; 9.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0389
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0389
Broken Link
http://secunia.com/advisories/11395
Broken Link
http://www.idefense.com/application/poi/display?id=102&type=vulnerabilities
Broken Link
http://www.securityfocus.com/bid/10157
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15880
More from Helix Universal Server
–
CVE-2004-0774
RealNetworks Helix Universal Server 9.0.2 for Linux and 9.0.3 for Windows allows remote attackers to cause a denial of service (CPU and memory exhaustion) via a POST request with…
–
CVE-2004-0049
Helix Universal Server/Proxy 9 and Mobile Server 10 allow remote attackers to cause a denial of service via certain HTTP POST messages to the Administration System port
–
CVE-2003-0725
Buffer overflow in the RTSP protocol parser for the View Source plug-in (vsrcplin.so or vsrcplin3260.dll) for RealNetworks Helix Universal Server 9 and RealSystem Server 8, 7 and…
–
CVE-2002-1643
Multiple buffer overflows in RealNetworks Helix Universal Server 9.0 (9.0.2.768) allow remote attackers to execute arbitrary code via (1) a long Transport field in a SETUP RTSP…