PT-2023-32799 · Unknown · Phz76 Rtspserver

Hu1Y40 · Published 2023-12-17 · Updated 2024-05-17 · CVE-2023-6888

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHZ76 RtspServer version 1.0.0

Description A critical issue was found in the ParseRequestLine function of the RtspMesaage.cpp file, leading to a stack-based buffer overflow. This issue can be exploited remotely. The exploit has been disclosed publicly. The vendor was contacted about this issue but did not respond.

Recommendations For PHZ76 RtspServer version 1.0.0, as a temporary workaround, consider disabling the ParseRequestLine function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

CVE-2023-6888

Affected Products

Phz76 Rtspserver

References · 8

• 🔥 https://github.com/hu1y40/PoC/blob/main/rtspserver_stackoverflow_poc.py · Exploit
• 🔥 http://huiyao.love/2023/12/08/rtspserver-stackoverflow-vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2023-6888 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6888 · Security Note
• https://t.me/cvenotify/64486 · Telegram Post
• https://vuldb.com/?ctiid.248248 · Note
• https://t.me/cvenotify/63897 · Telegram Post
• https://vuldb.com/?id.248248 · Note