Overview
CVE-2025-65408 describes a critical vulnerability in Live555 Streaming Media version 2018.09.02. This vulnerability, a NULL pointer dereference, exists within the `ADTSAudioFileServerMediaSubsession::createNewRTPSink()` function. An attacker can exploit this flaw by providing a specially crafted ADTS file to cause a Denial of Service (DoS) condition. This means that affected Live555 implementations can become unresponsive or crash when processing a malicious ADTS file, disrupting streaming services.
Technical Details
The vulnerability stems from improper handling of specific ADTS file structures within the `ADTSAudioFileServerMediaSubsession::createNewRTPSink()` function. When parsing the ADTS file, the code fails to adequately validate certain parameters, potentially leading to a NULL pointer being dereferenced. Specifically, the crafted ADTS file triggers a condition where a pointer expected to point to a valid memory location instead holds a NULL value. Subsequently, the code attempts to access memory through this NULL pointer, leading to a program crash and a Denial of Service.
The affected function, located within the Live555 codebase, is responsible for creating an RTP sink for streaming audio data from an ADTS file. The vulnerability is present because insufficient checks are performed on the ADTS file’s structure and content before the RTP sink is initialized.
CVSS Analysis
Currently, the CVSS score for CVE-2025-65408 is listed as N/A. This indicates that a formal CVSS score has not yet been assigned. However, given the potential for Denial of Service (DoS), a moderate to high severity score is likely, depending on the ease of exploitation and the impact on availability.
Possible Impact
The primary impact of CVE-2025-65408 is a Denial of Service (DoS). Successful exploitation can cause the Live555 server to crash, interrupting streaming services and potentially affecting other dependent applications. An attacker could repeatedly send crafted ADTS files to overwhelm the server, leading to prolonged downtime. The severity of the impact depends on the criticality of the affected streaming service. If the streaming server is public facing, the potential for widespread disruption increases significantly.
Mitigation or Patch Steps
Currently, there is no official patch available from the Live555 project for version 2018.09.02. However, several mitigation strategies can be considered:
- Upgrade Live555: Check if a newer version of Live555 is available that addresses this vulnerability. Although no official patch is currently available, more recent versions of the library may have addressed underlying issues affecting ADTS file parsing.
- Input Validation: Implement robust input validation for ADTS files before they are processed by the Live555 server. This includes verifying the file structure, header information, and data integrity.
- Rate Limiting: Implement rate limiting on the number of ADTS file requests to prevent an attacker from overwhelming the server with malicious files.
- Web Application Firewall (WAF): Utilize a WAF to filter out potentially malicious ADTS files based on predefined rules and signatures.
- Code Review (Advanced): If you have access to the Live555 source code, conduct a thorough code review of the `ADTSAudioFileServerMediaSubsession::createNewRTPSink()` function and related ADTS parsing routines. Implement checks to prevent NULL pointer dereferences and other potential vulnerabilities. This is a task for experienced C++ developers.
