CVE:CVE-2009-2534
CNNVD:CNNVD-200907-285
Helix Server是一款支持多格式、跨平台的流媒体服务器软件。
如果向Helix Server发送了缺少0x2F字节的畸形SETUP请求，就会在服务器中触发访问破坏导致崩溃。以下是触发异常的代码段：
/-----------
0047A490 |. 6A 2F PUSH 2F
0047A492 |. 56 PUSH ESI
0047A493 |. FF15 08425100 CALL DWORD PTR DS:[ lt; MSVCR71.strchr gt;]
 MSVCR71.strchr
- -----------/
只要发送了"/"(0x2F)字符，程序就会试图从0拷贝，触发访问破坏异常。
/-----------
0047A490 |. 6A 2F PUSH 2F
0047A492 |. 56 PUSH ESI
0047A493 |. FF15 08425100 CALL DWORD PTR DS:[ lt; MSVCR71.strchr gt;]
MSVCR71.strchr
- -----------/
solution:Upgrade realnetworks helix_server to a higher version than 12.0.1,11.0,12.0.0,and avoid the version (,12.0.1],11.0,12.0.0; Upgrade realnetworks helix_server_mobile to a higher version than 12.0.0,11.0,and avoid the version (,12.0.0],11.0