LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

live555 1.13 is affected by SEGV when executing function increaseBufferTo. This may result in remote code execution.

Summary A segmentation fault was found in live555

Details uname -a: Linux ubuntu 5.15.0-136-generic #147-Ubuntu SMP Sat Mar 15 15:53:30 UTC 2025 x8664 x8664 x8664 GNU/Linux

git last commit: commit a0eb8f9 Author: Roman Gaufman roman Date: Tue Oct 29 16:47:37 2024 +0000

poc45545329.zip

poc45545329.zip

run this command to reproduce： valgrind ./testProgs/testOnDemandRTSPServer aflnet-replay poc RTSP 8554

information from valgrind: === Validation Session: ./testOnDemandRTSPServer with replay === ==2783== Memcheck, a memory error detector ==2783== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==2783== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info ==2783== Command: ./testOnDemandRTSPServer 8554 ==2783== ==2783== Conditional jump or move depends on uninitialised value(s) ==2783== at 0x4DD39F: increaseBufferTo(UsageEnvironment&, int, int, unsigned int) (GroupsockHelper.cpp:522) ==2783== by 0x4AF7E1: OnDemandServerMediaSubsession::getStreamParameters(unsigned int, sockaddrstorage const&, Port const&, Port const&, int, unsigned char, unsigned char, TLSState, sockaddrstorage&, unsigned char&, unsigned char&, Port&, Port&, void&) (OnDemandServerMediaSubsession.cpp:214) ==2783== by 0x40F39D: RTSPServer::RTSPClientSession::handleCmdSETUPafterLookup2(ServerMediaSession) (RTSPServer.cpp:1588) ==2783== by 0x40DE15: RTSPServer::RTSPClientSession::handleCmdSETUPafterLookup1(ServerMediaSession) (RTSPServer.cpp:1404) ==2783== by 0x4AB631: GenericMediaServer::lookupServerMediaSession(char const, void ()(void, ServerMediaSession), void, unsigned char) (GenericMediaServer.cpp:48) ==2783== by 0x40D273: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:890) ==2783== by 0x4AD02B: GenericMediaServer::ClientConnection::incomingRequestHandler() (GenericMediaServer.cpp:323) ==2783== by 0x4E8EF2: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:171) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== Uninitialised value was created by a stack allocation ==2783== at 0x4AED70: OnDemandServerMediaSubsession::getStreamParameters(unsigned int, sockaddrstorage const&, Port const&, Port const&, int, unsigned char, unsigned char, TLSState, sockaddrstorage&, unsigned char&, unsigned char&, Port&, Port&, void&) (OnDemandServerMediaSubsession.cpp:123) ==2783== ==2783== Conditional jump or move depends on uninitialised value(s) ==2783== at 0x439095: WAVAudioFileServerMediaSubsession::testScaleFactor(float&) (WAVAudioFileServerMediaSubsession.cpp:214) ==2783== by 0x41092B: RTSPServer::RTSPClientSession::handleCmdPLAY(RTSPServer::RTSPClientConnection, ServerMediaSubsession, char const) (RTSPServer.cpp:1796) ==2783== by 0x410319: RTSPServer::RTSPClientSession::handleCmdwithinSession(RTSPServer::RTSPClientConnection, char const, char const, char const, char const) (RTSPServer.cpp:1742) ==2783== by 0x40D457: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:999) ==2783== by 0x4AD02B: GenericMediaServer::ClientConnection::incomingRequestHandler() (GenericMediaServer.cpp:323) ==2783== by 0x4E8EF2: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:171) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== Uninitialised value was created by a heap allocation ==2783== at 0x483BE63: operator new(unsigned long) (in /usr/lib/x8664-linux-gnu/valgrind/vgpreloadmemcheck-amd64-linux.so) ==2783== by 0x4382A6: WAVAudioFileServerMediaSubsession::createNew(UsageEnvironment&, char const, unsigned char, unsigned char) (WAVAudioFileServerMediaSubsession.cpp:30) ==2783== by 0x40432C: main (testOnDemandRTSPServer.cpp:213) ==2783== ==2783== Conditional jump or move depends on uninitialised value(s) ==2783== at 0x410AE1: RTSPServer::RTSPClientSession::handleCmdPLAY(RTSPServer::RTSPClientConnection, ServerMediaSubsession, char const) (RTSPServer.cpp:1820) ==2783== by 0x410319: RTSPServer::RTSPClientSession::handleCmdwithinSession(RTSPServer::RTSPClientConnection, char const, char const, char const, char const) (RTSPServer.cpp:1742) ==2783== by 0x40D457: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:999) ==2783== by 0x4AD02B: GenericMediaServer::ClientConnection::incomingRequestHandler() (GenericMediaServer.cpp:323) ==2783== by 0x4E8EF2: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:171) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== Uninitialised value was created by a heap allocation ==2783== at 0x483BE63: operator new(unsigned long) (in /usr/lib/x8664-linux-gnu/valgrind/vgpreloadmemcheck-amd64-linux.so) ==2783== by 0x4382A6: WAVAudioFileServerMediaSubsession::createNew(UsageEnvironment&, char const, unsigned char, unsigned char) (WAVAudioFileServerMediaSubsession.cpp:30) ==2783== by 0x40432C: main (testOnDemandRTSPServer.cpp:213) ==2783== ==2783== Conditional jump or move depends on uninitialised value(s) ==2783== at 0x410B6C: RTSPServer::RTSPClientSession::handleCmdPLAY(RTSPServer::RTSPClientConnection, ServerMediaSubsession, char const) (RTSPServer.cpp:1829) ==2783== by 0x410319: RTSPServer::RTSPClientSession::handleCmdwithinSession(RTSPServer::RTSPClientConnection, char const, char const, char const, char const) (RTSPServer.cpp:1742) ==2783== by 0x40D457: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:999) ==2783== by 0x4AD02B: GenericMediaServer::ClientConnection::incomingRequestHandler() (GenericMediaServer.cpp:323) ==2783== by 0x4E8EF2: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:171) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== Uninitialised value was created by a heap allocation ==2783== at 0x483BE63: operator new(unsigned long) (in /usr/lib/x8664-linux-gnu/valgrind/vgpreloadmemcheck-amd64-linux.so) ==2783== by 0x4382A6: WAVAudioFileServerMediaSubsession::createNew(UsageEnvironment&, char const, unsigned char, unsigned char) (WAVAudioFileServerMediaSubsession.cpp:30) ==2783== by 0x40432C: main (testOnDemandRTSPServer.cpp:213) ==2783== ==2783== Conditional jump or move depends on uninitialised value(s) ==2783== at 0x410BF7: RTSPServer::RTSPClientSession::handleCmdPLAY(RTSPServer::RTSPClientConnection, ServerMediaSubsession, char const) (RTSPServer.cpp:1831) ==2783== by 0x410319: RTSPServer::RTSPClientSession::handleCmdwithinSession(RTSPServer::RTSPClientConnection, char const, char const, char const, char const) (RTSPServer.cpp:1742) ==2783== by 0x40D457: RTSPServer::RTSPClientConnection::handleRequestBytes(int) (RTSPServer.cpp:999) ==2783== by 0x4AD02B: GenericMediaServer::ClientConnection::incomingRequestHandler() (GenericMediaServer.cpp:323) ==2783== by 0x4E8EF2: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:171) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== Uninitialised value was created by a heap allocation ==2783== at 0x483BE63: operator new(unsigned long) (in /usr/lib/x8664-linux-gnu/valgrind/vgpreloadmemcheck-amd64-linux.so) ==2783== by 0x4382A6: WAVAudioFileServerMediaSubsession::createNew(UsageEnvironment&, char const, unsigned char, unsigned char) (WAVAudioFileServerMediaSubsession.cpp:30) ==2783== by 0x40432C: main (testOnDemandRTSPServer.cpp:213) ==2783== ==2783== ==2783== Process terminating with default action of signal 15 (SIGTERM) ==2783== at 0x501E19A: select (select.c:41) ==2783== by 0x4E878F: BasicTaskScheduler::SingleStep(unsigned int) (BasicTaskScheduler.cpp:90) ==2783== by 0x4ED2EB: BasicTaskScheduler0::doEventLoop(char volatile) (BasicTaskScheduler0.cpp:87) ==2783== by 0x405465: main (testOnDemandRTSPServer.cpp:462) ==2783== ==2783== HEAP SUMMARY: ==2783== in use at exit: 48,725 bytes in 551 blocks ==2783== total heap usage: 2,241 allocs, 1,690 frees, 462,148 bytes allocated ==2783== ==2783== LEAK SUMMARY: ==2783== definitely lost: 0 bytes in 0 blocks ==2783== indirectly lost: 0 bytes in 0 blocks ==2783== possibly lost: 0 bytes in 0 blocks ==2783== still reachable: 48,725 bytes in 551 blocks ==2783== suppressed: 0 bytes in 0 blocks ==2783== Reachable blocks (those to which a pointer was found) are not shown. ==2783== To see them, rerun with: --leak-check=full --show-leak-kinds=all ==2783== ==2783== For lists of detected and suppressed errors, rerun with: -s ==2783== ERROR SUMMARY: 15 errors from 5 contexts (suppressed: 0 from 0)

Impact This vulnerability is capable of crashing software, modify memory, and possible remote execution.

A use-after-free in the ADTSAudioFileSource::samplingFrequency() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted ADTS/AAC file.

A buffer overflow in the getSideInfo2() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via a crafted MP3 stream.

A heap overflow in the MatroskaFile::createRTPSinkForTrackNumber() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MKV file.

A NULL pointer dereference in the ADTSAudioFileServerMediaSubsession::createNewRTPSink() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted ADTS file.

A use-after-free in the MPEG1or2Demux::newElementaryStream() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG Program stream.

A heap-use-after-free vulnerability was found in live555 version 2023.05.10 while handling the SETUP.

Live555 through 1.08 does not handle socket connections properly. A huge number of incoming socket connections in a short time invokes the error-handling module, in which a heap-based buffer overflow happens. An attacker can leverage this to launch a DoS attack.

Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.

liveMedia/FramedSource.cpp in Live555 through 1.08 allows an assertion failure and application exit via multiple SETUP and PLAY commands.

Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack.

Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.

Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.

Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive OnDemandServerMediaSubsession subclasses in Networks LIVE555 Streaming Media before 2021.3.16.

In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" command, when the command specifies seeking by absolute time.

Live555 before 2019.08.16 has a Use-After-Free because GenericMediaServer::createNewClientSessionWithId can generate the same client session ID in succession, which is mishandled by the MPEG1or2 and Matroska file demultiplexors.

In Live555 before 2019.02.27, malformed headers lead to invalid memory access in the parseAuthorizationHeader function.

In Live555 0.95, there is a buffer overflow via a large integer in a Content-Length HTTP header because handleRequestBytes has an unrestricted memmove.

In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field (username, realm, nonce, uri, or response), only the last instance can ever be freed.

liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a Use-After-Free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact.

A Denial of Service issue was discovered in the LIVE555 Streaming Media libraries as used in Live555 Media Server 0.93. It can cause an RTSPServer crash in handleHTTPCmdTunnelingPOST, when RTSP-over-HTTP tunneling is supported, via x-sessioncookie HTTP headers in a GET request and a POST request within the same TCP session. This occurs because of a call to an incorrect virtual function pointer in the readSocket function in GroupsockHelper.cpp.

An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library version 0.92. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.

The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.

The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2013.11.26, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a space character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6933.

The parseRTSPRequestString function in LIVE555 Media Server 2007.11.01 and earlier allows remote attackers to cause a denial of service (daemon crash) via a short RTSP query, which causes a negative number to be used during memory allocation.