PT-2007-2200 · Apple · Darwin Streaming Server

Published 2007-05-13 · Updated 2017-07-29 · CVE-2007-0749

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Darwin Streaming Server versions prior to 5.5.5

Description The issue is related to multiple stack-based buffer overflows in the is command function. This occurs when handling long values for the cmd or server parameters in an RTSP request. The buffer overflows can allow remote attackers to execute arbitrary code.

Recommendations For Darwin Streaming Server versions prior to 5.5.5, update to version 5.5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the RTSP endpoint to minimize the risk of exploitation. Avoid using long values for the cmd or server parameters in RTSP requests until the issue is resolved.

Fix

Related Identifiers

CVE-2007-0749

Affected Products

Darwin Streaming Server

References · 10

• http://docs.info.apple.com/article.html?artnum=305495 · Patch
• http://secunia.com/advisories/25193 · Vendor Advisory
• http://securityfocus.com/bid/23918 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-0749 · Security Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=533 · Patch
• http://lists.apple.com/archives/Security-announce/2007/May/msg00002.html · Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34222 · Note
• http://securitytracker.com/id?1018047 · Note
• http://osvdb.org/35976 · Note
• http://vupen.com/english/advisories/2007/1770 · Note