PT-2023-32799 · Unknown · Phz76 Rtspserver

Hu1Y40 · Publicado 2023-12-17 · Atualizado 2024-05-17 · CVE-2023-6888

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHZ76 RtspServer version 1.0.0

Description A critical issue was found in the ParseRequestLine function of the RtspMesaage.cpp file, leading to a stack-based buffer overflow. This issue can be exploited remotely. The exploit has been disclosed publicly. The vendor was contacted about this issue but did not respond.

Recommendations For PHZ76 RtspServer version 1.0.0, as a temporary workaround, consider disabling the ParseRequestLine function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Stack Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-121

CWE-787

Identificadores relacionados

CVE-2023-6888

Produtos afetados

Phz76 Rtspserver

Referências · 8

• 🔥 https://github.com/hu1y40/PoC/blob/main/rtspserver_stackoverflow_poc.py · Exploit
• 🔥 http://huiyao.love/2023/12/08/rtspserver-stackoverflow-vulnerability · Exploit
• https://t.me/cvenotify/64486 · Publicação no Telegram
• https://vuldb.com/?ctiid.248248 · Nota
• https://t.me/cvenotify/63897 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-6888 · Aviso do Fabricante
• https://vuldb.com/?id.248248 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-6888 · Nota de Segurança