CVE-2018-4013

What it actually does

Stack-based buffer overflow in the HTTP packet-parsing code of the LIVE555 RTSP server library version 0.92 allows remote code execution when a specially crafted packet is processed.

Why it matters to the business

Attackers can gain full control of servers running affected versions, risking data theft, service disruption, or use as an entry point for further attacks; the issue is years old with public exploits available but has not appeared in widespread campaigns.

How an attack unfolds

An attacker sends a maliciously crafted packet to the RTSP server endpoint; the packet triggers the stack overflow during parsing, allowing arbitrary code to be executed on the target system.

How to fix it

Upgrade weseek/growi to the fixed commit 03aa1ac03698678f3a510be5cc875b2b9ff82020 or later; replace any embedded LIVE555 RTSP library with a version newer than 0.92 and rebuild dependent applications.

How to confirm the fix worked

Confirm the LIVE555 library version or product build hash against the fixed commit; perform packet-fuzzing tests or review changelog entries for the buffer-handling functions.

Typical attack path

1. Identify exposed RTSP server instances running vulnerable LIVE555 0.92 or affected products
2. Craft and transmit a malicious packet targeting the HTTP parsing routine
3. Trigger stack-based buffer overflow to hijack control flow
4. Execute attacker-supplied code for persistence or further compromise

How to detect it

Review RTSP server logs for malformed or oversized packets, unexpected process crashes, or anomalous child process creation; correlate with network captures showing unusual HTTP headers or payload sizes.

What your security team should do

• Apply the listed fixed versions or library upgrades across all affected deployments
• Disable or restrict RTSP/HTTP exposure where possible until patched
• Scan for public exploit code usage in network traffic or process behavior