[Live-devel] Follow-up on confirmed Live555 RTSP Transport parsing bugs and CVE request

[曹博程]

Hi Ross,
 
Thank you for confirming that these are bugs.
 
Just to avoid ambiguity, the five issues I am referring to are:
  1. Out-of-range client_port values are accepted and truncated/wrapped, e.g. client_port=65535-65536 or client_port=99999-100000.
  2. Out-of-range interleaved channel values are accepted and truncated/wrapped, e.g. interleaved=256-257 or interleaved=999-1000.
  3. A Transport specification containing both unicast and multicast is accepted and treated as unicast.
  4. Multiple comma-separated transport specifications are not parsed independently, allowing parameters from a later specification to override values from an earlier one.
  5. An empty Transport header, or a Transport value without a transport-id, is accepted and results in a session being created with default RTP/UDP parameters.
 
As you noted, I understand that these are not serious bugs, are triggered only by non-conformant clients, and do not cause the server to crash. I will describe them as low-severity RTSP Transport header validation bugs.
 
I would like to ask whether you are comfortable with me submitting a CVE request for tracking purposes, including your confirmation that these are bugs and may be fixed in a future release.
 
Please also let me know whether you are comfortable with public disclosure of the technical details now, or whether you would prefer me to wait until a fixed release is available.
 
Best regards,
Bocheng Cao


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.live555.com/pipermail/live-devel/attachments/20260715/6aa73a00/attachment.htm>