CVE-2023-37117

What it actually does

Heap use-after-free triggered during RTSP SETUP request handling, enabling memory corruption that can lead to remote code execution or denial of service.

Why it matters to the business

Compromise or outage of media streaming servers, risking unauthorized access to video or audio content distribution infrastructure and potential downstream service disruption for dependent applications.

How an attack unfolds

An attacker sends a specially crafted RTSP SETUP request to a live555 server; the request causes the heap use-after-free during internal state handling, allowing the attacker to corrupt memory and achieve arbitrary code execution.

How to fix it

Upgrade live555 to a version released after 2023.05.10 that resolves the heap use-after-free; if no fixed release is available, apply community or vendor patches, disable unnecessary RTSP services, or migrate to a maintained alternative implementation.

How to confirm the fix worked

Confirm live555 version exceeds 2023.05.10, review changelog for the fix, and test RTSP SETUP handling under load or with available proof-of-concept traffic to ensure no crash or corruption occurs.

Typical attack path

1. Identify live555 server via network scanning or RTSP banner grabbing
2. Craft and send malicious RTSP SETUP request
3. Trigger use-after-free to corrupt heap memory
4. Leverage memory corruption for remote code execution

How to detect it

Inspect RTSP server logs for malformed or repeated SETUP requests that precede crashes; correlate with process memory dumps or heap sanitizer reports indicating use-after-free patterns.

What your security team should do

• Prioritize upgrade or replacement of live555 instances due to remote unauthenticated exploit availability
• Restrict external access to RTSP ports and enforce network segmentation for media servers
• Monitor RTSP traffic for anomalous SETUP requests and enable verbose logging on affected servers