PT-2019-1688 · Live Networks+2 · Live555+2

Published 2019-02-27 · Updated 2022-04-22 · CVE-2019-9215

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Live555 versions prior to 2019.02.27

Description The issue arises from insufficient input validation in the parseAuthorizationHeader function, leading to invalid memory access. This can be exploited by a remote attacker to execute arbitrary code or cause a denial of service.

Recommendations For versions prior to 2019.02.27, update to a version 2019.02.27 or later to resolve the issue. As a temporary workaround, consider disabling the parseAuthorizationHeader function until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-01282

CVE-2019-9215

DLA-1720-1

DSA-4408-1

MGASA-2019-0121

OPENSUSE-SU-2019:1797-1

OPENSUSE-SU-2019:1880-1

OPENSUSE-SU-2019_1797-1

OPENSUSE-SU-2020:0944-1

OPENSUSE-SU-2020_0944-1

OPENSUSE-SU-2024:11023-1

USN-4853-1

Affected Products

Live555

Suse

Ubuntu

References · 37

• https://bdu.fstec.ru/vul/2019-01282 · Security Note
• https://advisories.mageia.org/MGASA-2019-0121.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2019:1880-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0121 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4853-1 · Vendor Advisory
• http://live555.com/liveMedia/public/changelog.txt · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00024.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0944-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-9215 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00009.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-9215 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1797-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9215 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://debian.org/security/2019/dsa-4408 · Vendor Advisory