CVE-2019-7314
📋 TL;DR
CVE-2019-7314 is a use-after-free vulnerability in Live555's liblivemedia library that occurs when RTSP streams are terminated after RTP/RTCP-over-RTSP setup. This can cause RTSP servers to crash or potentially allow arbitrary code execution. Systems using Live555 for streaming media services are affected.
💻 Affected Systems
- Live555 Media Server
- Applications using liblivemedia library
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise
Likely Case
Denial of service through RTSP server crashes
If Mitigated
Limited to denial of service if exploit fails or is blocked
🎯 Exploit Status
Exploitation requires sending specially crafted RTSP termination requests
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2019.02.03 and later
Vendor Advisory: http://lists.live555.com/pipermail/live-devel/2019-February/021143.html
Restart Required: Yes
Instructions:
1. Download latest Live555 from http://www.live555.com/liveMedia/ 2. Compile and install 3. Restart affected services
🔧 Temporary Workarounds
Network segmentation
linuxRestrict RTSP server access to trusted networks only
iptables -A INPUT -p tcp --dport 554 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 554 -j DROP
Disable RTP/RTCP-over-RTSP
allConfigure Live555 to not use RTP/RTCP-over-RTSP feature
Modify RTSP server configuration to disable interleaved RTP/RTCP
🧯 If You Can't Patch
- Implement strict network access controls to RTSP port 554
- Deploy WAF/IPS with rules to detect and block malicious RTSP termination requests
🔍 How to Verify
Check if Vulnerable:
Check Live555 version: grep 'LIVE555_LIBRARY_VERSION_STRING' in source or check running service versionCheck Version:
live555MediaServer -h 2>&1 | grep version || strings /path/to/live555 | grep LIVE555Verify Fix Applied:
Verify version is 2019.02.03 or later and test RTSP stream termination📡 Detection & Monitoring
Log Indicators:
- Segmentation fault in Live555 logs
- Unexpected RTSP stream termination
- Server crash/restart events
Network Indicators:
- Multiple RTSP TEARDOWN requests to same session
- Abnormal RTSP termination patterns
SIEM Query:
source="live555.log" AND ("segmentation fault" OR "use-after-free" OR "crash")🔗 References
- http://lists.live555.com/pipermail/live-devel/2019-February/021143.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00009.html
- http://www.live555.com/liveMedia/public/changelog.txt
- https://lists.debian.org/debian-lts-announce/2019/02/msg00037.html
- https://seclists.org/bugtraq/2019/Mar/22
- https://security.gentoo.org/glsa/202005-06
- https://www.debian.org/security/2019/dsa-4408
- http://lists.live555.com/pipermail/live-devel/2019-February/021143.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00009.html
- http://www.live555.com/liveMedia/public/changelog.txt
- https://lists.debian.org/debian-lts-announce/2019/02/msg00037.html
- https://seclists.org/bugtraq/2019/Mar/22
- https://security.gentoo.org/glsa/202005-06
- https://www.debian.org/security/2019/dsa-4408
