CVE-2008-0225

CVE-2008-0225 is a vulnerability in xine-lib up to version 1.1.9 where a heap-based buffer overflow in rmff_dump_cont (rmff.c) can be triggered via the SDP Abstract attribute in an RTSP session. The root cause is the code path that disregards the max field in rmff_dump_header, leading to potentia...

QuickTime Player 7.3.1.70 - RTSP Buffer Overflow (PoC)

QuickTime Player 7.3.1.70 - RTSP Buffer Overflow PoC Luigi Auriemma Application: Quicktime Player http://www.apple.com/quicktime Versions: = 7.3.1.70 Platforms: Windows and Mac Bug: buffer-overflow Exploitation: remote Date: 10 Jan 2008 Thanx to: swirl for the help during the re-testing of the bu...

Apple QuickTime RTSP Response message Reason-Phrase buffer overflow vulnerability

Overview Apple QuickTime contains a buffer overflow vulnerability that may allow a remote, unauthenticated attacker to cause a denial-of-service condition and possibly execute arbitrary code. Description Real Time Streaming Protocol RTSP is a protocol that is used by streaming media systems. Appl...

QuickTime Player <= 7.3.1.70 (rtsp) Buffer Overflow Vulnerability

Exploit for unknown platform in category dos / poc ================================================================= Quicktime Player = 7.3.1.70 rtsp Buffer Overflow Vulnerability ================================================================= Luigi Auriemma Application: Quicktime Player...

CVE-2008-0225: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the rmffdumpcont function in input/libreal/rmff.c in xine-lib 1.1.9 and earlier allows remote attackers to execute arbitrary code via the SDP Abstract attribute in an RTSP session, related to the rmffdumpheader function and related to disregarding the max field. NOTE...

QuickTime Player 7.3.1.70 - 'RTSP' Buffer Overflow (PoC)

Luigi Auriemma Application: Quicktime Player http://www.apple.com/quicktime Versions: = 7.3.1.70 Platforms: Windows and Mac Bug: buffer-overflow Exploitation: remote Date: 10 Jan 2008 Thanx to: swirl for the help during the re-testing of the bug Author: Luigi Auriemma e-mail: [email protected]...

CVE-2007-6628

LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service NULL dereference and daemon crash via 1 a malformed Transport header, which triggers misparsing in parsetransportheader in RTSPsetup.c, as demonstrated by a Transport header that contains only a...

CVE-2007-6630

The Urlinit function in utils/url.c in Netembryo 0.0.4, when used by LScube Feng, allows remote attackers to cause a denial of service NULL dereference and daemon crash via a malformed URI containing a "/:" sequence, as demonstrated by a "DESCRIBE /: RTSP/1.0" request...

Design/Logic Flaw

LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service NULL dereference and daemon crash via 1 a malformed Transport header, which triggers misparsing in parsetransportheader in RTSPsetup.c, as demonstrated by a Transport header that contains only a...

CVE-2007-6626

Multiple buffer overflows in the RTSPvalidresponsemsg function in RTSPstatemachine.c in LScube Feng 0.1.15 and earlier allow remote attackers to execute arbitrary code via 1 a long first line of a response, as demonstrated by a long VER line; or 2 a long second line of a response, as demonstrated...

CVE-2007-6631

Multiple buffer overflows in LScube libnemesi 0.6.4-rc1 and earlier allow remote attackers to execute arbitrary code via 1 a reply that begins with a long version string, which triggers an overflow in handlertsppkt in rtsphandlers.c; long headers that trigger overflows in 2 sendpauserequest, 3...

CVE-2007-6628

CVE-2007-6628 affects LScube Feng 0.1.15 and earlier. The issue allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via two malformed headers: (1) Transport header triggering misparsing in RTSP_setup.c’s parse_transport_header (example: a header containing onl...

CVE-2007-6627

CVE-2007-6627 affects LScube Feng

CVE-2007-6631

CVE-2007-6631 describes multiple buffer overflows in the LScube libnemesi 0.6.4-rc1 and earlier. The vulnerability allows remote code execution via crafted RTSP traffic, including: a reply beginning with a long version string that overflows handle_rtsp_pkt in rtsp_handlers.c; excessively long hea...

CVE-2007-6626

Multiple buffer overflows in the RTSPvalidresponsemsg function in RTSPstatemachine.c in LScube Feng 0.1.15 and earlier allow remote attackers to execute arbitrary code via 1 a long first line of a response, as demonstrated by a long VER line; or 2 a long second line of a response, as demonstrated...

Feng多个远程溢出及拒绝服务漏洞

BUGTRAQ ID: 27049 Feng是意大利Politecnico di Torino大学所开发的开源RTSP/RTP流媒体服务器。 Feng的实现上存在多个缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制用户系统。 --------------------------------------------------- A RTSPvalidresponsemsg中缓冲区溢出（1） ---------------------------------------------------...

Libnemesi缓冲区溢出漏洞

BUGTRAQ ID: 27048 CNCAN ID:CNCAN-2007122803 Libnemesi是一款实现RTSP/RTP流的开放源代码库。 Libnemesi存在多个缓冲区溢出问题，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 问题一是handlertsppkt函数处理服务器应答存在缓冲区溢出。 问题二是sendrequest函数存在缓冲区溢出。 问题三是gettransportstr使用strncpy时存在缓冲区溢出。 Politecnico di Torino Libnemesi 0.6.4-rc1 厂商解决方案 ----------- 升级程序：...

Feng RTSP streaming server multiple security vulnerabilities

Multiple buffer overflows and DoS conditions...

Multiple vulnerabilities in libnemesi 0.6.4-rc1

Luigi Auriemma Application: libnemesi http://live.polito.it/documentation/libnemesi Versions: = 0.6.4-rc1 Platforms: nix Bugs: A buffer-overflow in handlertsppkt B buffer-overflow in the sendrequest functions C buffer-overflow in gettransportstr Exploitation: remote Date: 27 Dec 2007 Author: Luig...

Multiple vulnerabilities in Feng 0.1.15

Luigi Auriemma Application: Feng http://live.polito.it/documentation/feng Versions: = 0.1.15 Platforms: nix Bugs: A first buffer-overflow in RTSPvalidresponsemsg B second buffer-overflow in RTSPvalidresponsemsg C crash in RTSPremovemsg D NULL pointer in parsetransportheader E NULL pointer in...