CVE-2024-44331

What it actually does

Incorrect access control in the RTSP media handling component allows remote unauthenticated attackers to trigger denial of service through repeated specially crafted hexstream requests.

Why it matters to the business

Disruption of availability for any media streaming or RTSP-dependent services running on the affected platforms, with potential operational downtime in environments using the listed SUSE deployments.

How an attack unfolds

An attacker identifies an exposed RTSP server instance and sends a series of malformed hexstream requests that bypass intended access controls, resulting in resource exhaustion or service crash.

How to fix it

Update affected packages to the fixed versions clamav 0.100.3-0.20.21.1 on SUSE Linux Enterprise Point of Sale 11 SP3 and SUSE Linux Enterprise Server 11 SP4-LTSS.

How to confirm the fix worked

Confirm installed package versions match the fixed releases and test that the server rejects or handles malformed hexstream requests without crashing.

Typical attack path

1. Scan for publicly reachable RTSP endpoints
2. Craft and transmit sequences of hexstream requests targeting the media handling path
3. Observe repeated requests leading to denial of service condition

How to detect it

Review RTSP server logs for repeated malformed or hex-encoded request patterns that coincide with service availability issues.

What your security team should do

• Apply the listed package updates to all affected SUSE systems without delay
• Restrict network access to RTSP ports to trusted sources only
• Monitor for anomalous request patterns targeting RTSP services