CVE-2019-6256
📋 TL;DR
This vulnerability allows remote attackers to cause a denial of service (crash) in LIVE555 Media Server by sending specially crafted HTTP headers in RTSP-over-HTTP tunneling requests. It affects systems running Live555 Media Server 0.93 with RTSP-over-HTTP tunneling enabled. The crash occurs due to an incorrect virtual function pointer call in the readSocket function.
💻 Affected Systems
- Live555 Media Server
- LIVE555 Streaming Media libraries
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the media streaming server, making all streaming services unavailable until manual restart.
Likely Case
Service crashes requiring manual intervention to restart, causing temporary streaming service outages.
If Mitigated
Minimal impact if RTSP-over-HTTP tunneling is disabled or proper network segmentation is in place.
🎯 Exploit Status
The vulnerability is triggered via simple HTTP requests with specific headers, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 0.93
Vendor Advisory: https://github.com/rgaufman/live555/issues/19
Restart Required: Yes
Instructions:
1. Update to the latest version of Live555 Media Server. 2. Replace the vulnerable libraries with patched versions. 3. Restart the media server service.
🔧 Temporary Workarounds
Disable RTSP-over-HTTP tunneling
allPrevents exploitation by disabling the vulnerable feature
Modify server configuration to disable RTSP-over-HTTP tunneling support
Network filtering
allBlock malicious HTTP headers at network perimeter
Configure firewall/WAF to block requests containing 'x-sessioncookie' header in specific patterns
🧯 If You Can't Patch
- Implement strict network segmentation to isolate media servers from untrusted networks
- Deploy web application firewall (WAF) rules to block malicious HTTP header patterns
🔍 How to Verify
Check if Vulnerable:
Check if running Live555 Media Server version 0.93 with RTSP-over-HTTP tunneling enabledCheck Version:
Check server logs or run the media server with --version flagVerify Fix Applied:
Verify version is updated beyond 0.93 and test RTSP-over-HTTP functionality📡 Detection & Monitoring
Log Indicators:
- Server crash logs
- Abnormal termination of live555 process
- Error messages mentioning handleHTTPCmd_TunnelingPOST or readSocket
Network Indicators:
- Multiple HTTP requests with x-sessioncookie headers
- RTSP-over-HTTP tunneling requests followed by server unresponsiveness
SIEM Query:
source="live555.log" AND ("crash" OR "segmentation fault" OR "handleHTTPCmd_TunnelingPOST")🔗 References
- https://github.com/rgaufman/live555/issues/19
- https://lists.debian.org/debian-lts-announce/2019/02/msg00037.html
- https://seclists.org/bugtraq/2019/Mar/22
- https://security.gentoo.org/glsa/202005-06
- https://www.debian.org/security/2019/dsa-4408
- https://github.com/rgaufman/live555/issues/19
- https://lists.debian.org/debian-lts-announce/2019/02/msg00037.html
- https://seclists.org/bugtraq/2019/Mar/22
- https://security.gentoo.org/glsa/202005-06
- https://www.debian.org/security/2019/dsa-4408
