LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.
liveMedia/FramedSource.cpp in Live555 through 1.08 allows an assertion failure and application exit via multiple SETUP and PLAY commands.
Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.
Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack.
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
live555 1.13 is affected by SEGV when executing function increaseBufferTo. This may result in remote code execution.
Summary A segmentation fault was found in live555
Details uname -a: Linux ubuntu 5.15.0-136-generic #147-Ubuntu SMP Sat Mar 15 15:53:30 UTC 2025 x8664 x8664 x8664 GNU/Linux
git last commit: commit a0eb8f9 Author: Roman Gaufman roman Date: Tue Oct 29 16:47:37 2024 +0000
poc45545329.zip
poc45545329.zip
run this command to reproduce： valgrind ./testProgs/testOnDemandRTSPServer aflnet-replay poc RTSP 8554
information from valgrind: === Validation Session: ./testOnDemandRTSPServer with replay === ==2783== Memcheck, a memory error detector ==2783== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==2783== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info ==2783== Command: ./testOnDemandRTSPServer 8554 ==2783== ==2783== Conditional jump or move depends on uninitialised value(s) ==2783== at 0x4DD39F: increaseBufferTo(UsageEnvironment&, int, int, unsigned int) (GroupsockHelper.cpp:522) ==2783== by 0x4AF7E1: OnDemandServerMediaSubsession::getStreamParameters(unsigned int, sockaddrstorage const&, Port const&, Port const&, int, unsigned char, unsigned char, TLSState, sockaddrstorage&, unsigned char&, unsigned char&, Port&, Port&, void&) (OnDemandServerMediaSubsession.cpp:214) ==2783== by 0x40F39D: RTSPServer::RTSPClientSession::handleCmdSETUPafterLookup2(ServerMediaSession) (RTSPServer.cpp:1588) ==2783== by 0x40DE15: RTSPServer::RTSPClientSession::handleCmdSETUPafterLookup1(ServerMediaSession) (RTSPServer.cpp:1404) ==2783== by 0x4AB631: GenericMediaServer::lookupServerMediaSession(char const, void ()(void, ServerMediaSession), void, unsigned char) (GenericMediaServer.cpp:48) ==2783== by 0x40D273: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:890) ==2783== by 0x4AD02B: GenericMediaServer::ClientConnection::incomingRequestHandler() (GenericMediaServer.cpp:323) ==2783== by 0x4E8EF2: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:171) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== Uninitialised value was created by a stack allocation ==2783== at 0x4AED70: OnDemandServerMediaSubsession::getStreamParameters(unsigned int, sockaddrstorage const&, Port const&, Port const&, int, unsigned char, unsigned char, TLSState, sockaddrstorage&, unsigned char&, unsigned char&, Port&, Port&, void&) (OnDemandServerMediaSubsession.cpp:123) ==2783== ==2783== Conditional jump or move depends on uninitialised value(s) ==2783== at 0x439095: WAVAudioFileServerMediaSubsession::testScaleFactor(float&) (WAVAudioFileServerMediaSubsession.cpp:214) ==2783== by 0x41092B: RTSPServer::RTSPClientSession::handleCmdPLAY(RTSPServer::RTSPClientConnection, ServerMediaSubsession, char const) (RTSPServer.cpp:1796) ==2783== by 0x410319: RTSPServer::RTSPClientSession::handleCmdwithinSession(RTSPServer::RTSPClientConnection, char const, char const, char const, char const) (RTSPServer.cpp:1742) ==2783== by 0x40D457: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:999) ==2783== by 0x4AD02B: GenericMediaServer::ClientConnection::incomingRequestHandler() (GenericMediaServer.cpp:323) ==2783== by 0x4E8EF2: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:171) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== Uninitialised value was created by a heap allocation ==2783== at 0x483BE63: operator new(unsigned long) (in /usr/lib/x8664-linux-gnu/valgrind/vgpreloadmemcheck-amd64-linux.so) ==2783== by 0x4382A6: WAVAudioFileServerMediaSubsession::createNew(UsageEnvironment&, char const, unsigned char, unsigned char) (WAVAudioFileServerMediaSubsession.cpp:30) ==2783== by 0x40432C: main (testOnDemandRTSPServer.cpp:213) ==2783== ==2783== Conditional jump or move depends on uninitialised value(s) ==2783== at 0x410AE1: RTSPServer::RTSPClientSession::handleCmdPLAY(RTSPServer::RTSPClientConnection, ServerMediaSubsession, char const) (RTSPServer.cpp:1820) ==2783== by 0x410319: RTSPServer::RTSPClientSession::handleCmdwithinSession(RTSPServer::RTSPClientConnection, char const, char const, char const, char const) (RTSPServer.cpp:1742) ==2783== by 0x40D457: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:999) ==2783== by 0x4AD02B: GenericMediaServer::ClientConnection::incomingRequestHandler() (GenericMediaServer.cpp:323) ==2783== by 0x4E8EF2: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:171) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== Uninitialised value was created by a heap allocation ==2783== at 0x483BE63: operator new(unsigned long) (in /usr/lib/x8664-linux-gnu/valgrind/vgpreloadmemcheck-amd64-linux.so) ==2783== by 0x4382A6: WAVAudioFileServerMediaSubsession::createNew(UsageEnvironment&, char const, unsigned char, unsigned char) (WAVAudioFileServerMediaSubsession.cpp:30) ==2783== by 0x40432C: main (testOnDemandRTSPServer.cpp:213) ==2783== ==2783== Conditional jump or move depends on uninitialised value(s) ==2783== at 0x410B6C: RTSPServer::RTSPClientSession::handleCmdPLAY(RTSPServer::RTSPClientConnection, ServerMediaSubsession, char const) (RTSPServer.cpp:1829) ==2783== by 0x410319: RTSPServer::RTSPClientSession::handleCmdwithinSession(RTSPServer::RTSPClientConnection, char const, char const, char const, char const) (RTSPServer.cpp:1742) ==2783== by 0x40D457: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:999) ==2783== by 0x4AD02B: GenericMediaServer::ClientConnection::incomingRequestHandler() (GenericMediaServer.cpp:323) ==2783== by 0x4E8EF2: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:171) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== Uninitialised value was created by a heap allocation ==2783== at 0x483BE63: operator new(unsigned long) (in /usr/lib/x8664-linux-gnu/valgrind/vgpreloadmemcheck-amd64-linux.so) ==2783== by 0x4382A6: WAVAudioFileServerMediaSubsession::createNew(UsageEnvironment&, char const, unsigned char, unsigned char) (WAVAudioFileServerMediaSubsession.cpp:30) ==2783== by 0x40432C: main (testOnDemandRTSPServer.cpp:213) ==2783== ==2783== Conditional jump or move depends on uninitialised value(s) ==2783== at 0x410BF7: RTSPServer::RTSPClientSession::handleCmdPLAY(RTSPServer::RTSPClientConnection, ServerMediaSubsession, char const) (RTSPServer.cpp:1831) ==2783== by 0x410319: RTSPServer::RTSPClientSession::handleCmdwithinSession(RTSPServer::RTSPClientConnection, char const, char const, char const, char const) (RTSPServer.cpp:1742) ==2783== by 0x40D457: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:999) ==2783== by 0x4AD02B: GenericMediaServer::ClientConnection::incomingRequestHandler() (GenericMediaServer.cpp:323) ==2783== by 0x4E8EF2: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:171) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== Uninitialised value was created by a heap allocation ==2783== at 0x483BE63: operator new(unsigned long) (in /usr/lib/x8664-linux-gnu/valgrind/vgpreloadmemcheck-amd64-linux.so) ==2783== by 0x4382A6: WAVAudioFileServerMediaSubsession::createNew(UsageEnvironment&, char const, unsigned char, unsigned char) (WAVAudioFileServerMediaSubsession.cpp:30) ==2783== by 0x40432C: main (testOnDemandRTSPServer.cpp:213) ==2783== ==2783== ==2783== Process terminating with default action of signal 15 (SIGTERM) ==2783== at 0x501E19A: select (select.c:41) ==2783== by 0x4E878F: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:90) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== ==2783== HEAP SUMMARY: ==2783== in use at exit: 48,725 bytes in 551 blocks ==2783== total heap usage: 2,241 allocs, 1,690 frees, 462,148 bytes allocated ==2783== ==2783== LEAK SUMMARY: ==2783== definitely lost: 0 bytes in 0 blocks ==2783== indirectly lost: 0 bytes in 0 blocks ==2783== possibly lost: 0 bytes in 0 blocks ==2783== still reachable: 48,725 bytes in 551 blocks ==2783== suppressed: 0 bytes in 0 blocks ==2783== Reachable blocks (those to which a pointer was found) are not shown. ==2783== To see them, rerun with: --leak-check=full --show-leak-kinds=all ==2783== ==2783== For lists of detected and suppressed errors, rerun with: -s ==2783== ERROR SUMMARY: 15 errors from 5 contexts (suppressed: 0 from 0)
Impact This vulnerability is capable of crashing software, modify memory, and possible remote execution.