Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and daemon crash.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP     commands for the same track causes a Use-After-Free and daemon crash. (CVE-2021-38381)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202407-23 (LIVE555 Media Server: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in LIVE555 Media Server. Please review the CVE identifiers     referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-
    based buffer over-read. An attacker can leverage this to launch a DoS attack. (CVE-2021-38380)

  - Live555 through 1.08 does not handle MPEG-1 or 2 files properly. Sending two successive RTSP SETUP
    commands for the same track causes a Use-After-Free and daemon crash. (CVE-2021-38381)

  - Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP
    commands for the same track causes a Use-After-Free and daemon crash. (CVE-2021-38382)

  - OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_bind() in misc.c. (CVE-2021-38383)

ID	Name	Product	Family	Type	Severity
262806	Linux Distros Unpatched Vulnerability : CVE-2021-38381	Nessus	Misc.	Local	medium
202061	GLSA-202407-23 : LIVE555 Media Server: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
405466	Alpine: multiple live-media packages: security update to 2022.02.07-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
405466	Alpine: multiple live-media packages: security update to 2022.02.07-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical

Detections

Analytics

CVE-2021-38381

medium

Tenable Plugins

medium

critical

critical

critical