LIVE555 Media Server: Denial of Service

1. Gentoo Linux Security Advisory

Package	Vulnerable versions	Unaffected versions	Architecture(s)
media-plugins/live	< 2008.02.08	>= 2008.02.08	All supported architectures

Related bugreports: #204065

A Denial of Service vulnerability has been reported in LIVE555 Media Server.

2. Impact Information

LIVE555 Media Server is a set of libraries for multimedia streaming.

Luigi Auriemma reported a signedness error in the parseRTSPRequestString() function when processing short RTSP queries.

A remote attacker could send a specially crafted RTSP query to the vulnerable server, resulting in a crash.

3. Resolution Information

There is no known workaround at this time.

All LIVE555 Media Server users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-plugins/live-2008.02.08"

Note: Due to ABI changes, applications built against LIVE555 Media Server such as VLC or MPlayer should also be rebuilt.

4. References

Updated March 13, 2008

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.