LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack.
Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.
Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.
liveMedia/FramedSource.cpp in Live555 through 1.08 allows an assertion failure and application exit via multiple SETUP and PLAY commands.
live555 1.13 is affected by SEGV when executing function increaseBufferTo. This may result in remote code execution.
Summary A segmentation fault was found in live555
Details uname -a: Linux ubuntu 5.15.0-136-generic #147-Ubuntu SMP Sat Mar 15 15:53:30 UTC 2025 x8664 x8664 x8664 GNU/Linux
git last commit: commit a0eb8f9 Author: Roman Gaufman roman Date: Tue Oct 29 16:47:37 2024 +0000
poc45545329.zip
poc45545329.zip
run this command to reproduce： valgrind ./testProgs/testOnDemandRTSPServer aflnet-replay poc RTSP 8554
information from valgrind: === Validation Session: ./testOnDemandRTSPServer with replay === ==2783== Memcheck, a memory error detector ==2783== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==2783== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info ==2783== Command: ./testOnDemandRTSPServer 8554 ==2783== ==2783== Conditional jump or move depends on uninitialised value(s) ==2783== at 0x4DD39F: increaseBufferTo(UsageEnvironment&, int, int, unsigned int) (GroupsockHelper.cpp:522) ==2783== by 0x4AF7E1: OnDemandServerMediaSubsession::getStreamParameters(unsigned int, sockaddrstorage const&, Port const&, Port const&, int, unsigned char, unsigned char, TLSState, sockaddrstorage&, unsigned char&, unsigned char&, Port&, Port&, void&) (OnDemandServerMediaSubsession.cpp:214) ==2783== by 0x40F39D: RTSPServer::RTSPClientSession::handleCmdSETUPafterLookup2(ServerMediaSession) (RTSPServer.cpp:1588) ==2783== by 0x40DE15: RTSPServer::RTSPClientSession::handleCmdSETUPafterLookup1(ServerMediaSession) (RTSPServer.cpp:1404) ==2783== by 0x4AB631: GenericMediaServer::lookupServerMediaSession(char const, void ()(void, ServerMediaSession), void, unsigned char) (GenericMediaServer.cpp:48) ==2783== by 0x40D273: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:890) ==2783== by 0x4AD02B: GenericMediaServer::ClientConnection::incomingRequestHandler() (GenericMediaServer.cpp:323) ==2783== by 0x4E8EF2: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:171) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== Uninitialised value was created by a stack allocation ==2783== at 0x4AED70: OnDemandServerMediaSubsession::getStreamParameters(unsigned int, sockaddrstorage const&, Port const&, Port const&, int, unsigned char, unsigned char, TLSState, sockaddrstorage&, unsigned char&, unsigned char&, Port&, Port&, void&) (OnDemandServerMediaSubsession.cpp:123) ==2783== ==2783== Conditional jump or move depends on uninitialised value(s) ==2783== at 0x439095: WAVAudioFileServerMediaSubsession::testScaleFactor(float&) (WAVAudioFileServerMediaSubsession.cpp:214) ==2783== by 0x41092B: RTSPServer::RTSPClientSession::handleCmdPLAY(RTSPServer::RTSPClientConnection, ServerMediaSubsession, char const) (RTSPServer.cpp:1796) ==2783== by 0x410319: RTSPServer::RTSPClientSession::handleCmdwithinSession(RTSPServer::RTSPClientConnection, char const, char const, char const, char const) (RTSPServer.cpp:1742) ==2783== by 0x40D457: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:999) ==2783== by 0x4AD02B: GenericMediaServer::ClientConnection::incomingRequestHandler() (GenericMediaServer.cpp:323) ==2783== by 0x4E8EF2: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:171) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== Uninitialised value was created by a heap allocation ==2783== at 0x483BE63: operator new(unsigned long) (in /usr/lib/x8664-linux-gnu/valgrind/vgpreloadmemcheck-amd64-linux.so) ==2783== by 0x4382A6: WAVAudioFileServerMediaSubsession::createNew(UsageEnvironment&, char const, unsigned char, unsigned char) (WAVAudioFileServerMediaSubsession.cpp:30) ==2783== by 0x40432C: main (testOnDemandRTSPServer.cpp:213) ==2783== ==2783== Conditional jump or move depends on uninitialised value(s) ==2783== at 0x410AE1: RTSPServer::RTSPClientSession::handleCmdPLAY(RTSPServer::RTSPClientConnection, ServerMediaSubsession, char const) (RTSPServer.cpp:1820) ==2783== by 0x410319: RTSPServer::RTSPClientSession::handleCmdwithinSession(RTSPServer::RTSPClientConnection, char const, char const, char const, char const) (RTSPServer.cpp:1742) ==2783== by 0x40D457: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:999) ==2783== by 0x4AD02B: GenericMediaServer::ClientConnection::incomingRequestHandler() (GenericMediaServer.cpp:323) ==2783== by 0x4E8EF2: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:171) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== Uninitialised value was created by a heap allocation ==2783== at 0x483BE63: operator new(unsigned long) (in /usr/lib/x8664-linux-gnu/valgrind/vgpreloadmemcheck-amd64-linux.so) ==2783== by 0x4382A6: WAVAudioFileServerMediaSubsession::createNew(UsageEnvironment&, char const, unsigned char, unsigned char) (WAVAudioFileServerMediaSubsession.cpp:30) ==2783== by 0x40432C: main (testOnDemandRTSPServer.cpp:213) ==2783== ==2783== Conditional jump or move depends on uninitialised value(s) ==2783== at 0x410B6C: RTSPServer::RTSPClientSession::handleCmdPLAY(RTSPServer::RTSPClientConnection, ServerMediaSubsession, char const) (RTSPServer.cpp:1829) ==2783== by 0x410319: RTSPServer::RTSPClientSession::handleCmdwithinSession(RTSPServer::RTSPClientConnection, char const, char const, char const, char const) (RTSPServer.cpp:1742) ==2783== by 0x40D457: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:999) ==2783== by 0x4AD02B: GenericMediaServer::ClientConnection::incomingRequestHandler() (GenericMediaServer.cpp:323) ==2783== by 0x4E8EF2: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:171) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== Uninitialised value was created by a heap allocation ==2783== at 0x483BE63: operator new(unsigned long) (in /usr/lib/x8664-linux-gnu/valgrind/vgpreloadmemcheck-amd64-linux.so) ==2783== by 0x4382A6: WAVAudioFileServerMediaSubsession::createNew(UsageEnvironment&, char const, unsigned char, unsigned char) (WAVAudioFileServerMediaSubsession.cpp:30) ==2783== by 0x40432C: main (testOnDemandRTSPServer.cpp:213) ==2783== ==2783== Conditional jump or move depends on uninitialised value(s) ==2783== at 0x410BF7: RTSPServer::RTSPClientSession::handleCmdPLAY(RTSPServer::RTSPClientConnection, ServerMediaSubsession, char const) (RTSPServer.cpp:1831) ==2783== by 0x410319: RTSPServer::RTSPClientSession::handleCmdwithinSession(RTSPServer::RTSPClientConnection, char const, char const, char const, char const) (RTSPServer.cpp:1742) ==2783== by 0x40D457: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:999) ==2783== by 0x4AD02B: GenericMediaServer::ClientConnection::incomingRequestHandler() (GenericMediaServer.cpp:323) ==2783== by 0x4E8EF2: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:171) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== Uninitialised value was created by a heap allocation ==2783== at 0x483BE63: operator new(unsigned long) (in /usr/lib/x8664-linux-gnu/valgrind/vgpreloadmemcheck-amd64-linux.so) ==2783== by 0x4382A6: WAVAudioFileServerMediaSubsession::createNew(UsageEnvironment&, char const, unsigned char, unsigned char) (WAVAudioFileServerMediaSubsession.cpp:30) ==2783== by 0x40432C: main (testOnDemandRTSPServer.cpp:213) ==2783== ==2783== ==2783== Process terminating with default action of signal 15 (SIGTERM) ==2783== at 0x501E19A: select (select.c:41) ==2783== by 0x4E878F: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:90) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== ==2783== HEAP SUMMARY: ==2783== in use at exit: 48,725 bytes in 551 blocks ==2783== total heap usage: 2,241 allocs, 1,690 frees, 462,148 bytes allocated ==2783== ==2783== LEAK SUMMARY: ==2783== definitely lost: 0 bytes in 0 blocks ==2783== indirectly lost: 0 bytes in 0 blocks ==2783== possibly lost: 0 bytes in 0 blocks ==2783== still reachable: 48,725 bytes in 551 blocks ==2783== suppressed: 0 bytes in 0 blocks ==2783== Reachable blocks (those to which a pointer was found) are not shown. ==2783== To see them, rerun with: --leak-check=full --show-leak-kinds=all ==2783== ==2783== For lists of detected and suppressed errors, rerun with: -s ==2783== ERROR SUMMARY: 15 errors from 5 contexts (suppressed: 0 from 0)
Impact This vulnerability is capable of crashing software, modify memory, and possible remote execution.