full-disclosure - Crash in LIVE555 Media Server 2007.11.01

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 18 Nov 2007 19:45:51 +0100
From: Luigi Auriemma <aluigi@...istici.org>
To: bugtraq@...urityfocus.com, bugs@...uritytracker.com,
	news@...uriteam.com, full-disclosure@...ts.grok.org.uk, vuln@...unia.com,
	packet@...ketstormsecurity.org
Subject: Crash in LIVE555 Media Server 2007.11.01


#######################################################################

                             Luigi Auriemma

Application:  LIVE555 Media Server
              http://www.live555.com/mediaServer/
Versions:     <= 2007.11.01
Platforms:    *nix, Windows, Mac and others
Bug:          crash caused by access to unallocated memory
Exploitation: remote, versus server
Date:         18 Nov 2007
Author:       Luigi Auriemma
              e-mail: aluigi@...istici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


LIVE555 Media Server is an open source RTSP server application released
under LGPL.


#######################################################################

======
2) Bug
======


The function which handles the incoming queries from the clients is
affected by a vulnerability which allows an attacker to crash the
server remotely using the smallest RTSP query possible to use.

This problem is caused by the absence of an instruction for checking if
the amount of client's data (reqStrSize) is longer or equal than 8
bytes because the function makes use of unsigned numbers, so "7 - 8" is
not -1 but 4294967295, resulting in a crash caused by the reaching of
the end of the allocated memory.

>>From liveMedia/RTSPCommon:

Boolean parseRTSPRequestString(char const* reqStr,
                   unsigned reqStrSize,
  ...
  unsigned i;
  for (i = 0; i < resultCmdNameMaxSize-1 && i < reqStrSize; ++i) {

    ...

  // Skip over the prefix of any "rtsp://" or "rtsp:/" URL that follows:
  unsigned j = i+1;
  while (j < reqStrSize && (reqStr[j] == ' ' || reqStr[j] == '\t')) ++j;
  for (j = i+1; j < reqStrSize-8; ++j) {
    ...


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/live555x.zip


#######################################################################

======
4) Fix
======


Version 2007.11.18


#######################################################################


--- 
Luigi Auriemma
http://aluigi.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/