CVE-2025-65404

Executive Summary

CVE-2025-65404 describes a buffer overflow vulnerability in the getSideInfo2() function of Live555 Streaming Media v2018.09.02. An attacker can trigger a Denial of Service (DoS) by sending a crafted MP3 stream. The vulnerability resides in the MP3 audio parsing logic, where insufficient bounds checking on side information leads to memory corruption. No public exploit code or patch is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the lack of a patch makes affected systems vulnerable to targeted attacks.

Supply Chain & Package Security

Live555 is a widely used streaming media library, often integrated into custom media servers, IP cameras, and embedded devices. The vulnerability is in the core library, not a package manager distribution. Organizations using Live555 in their supply chain should inventory all instances and apply vendor patches when available.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No vector provided)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High
• Threat Level: Medium (DoS impact, no patch, low EPSS)

Deep Dive & Mechanics

The getSideInfo2() function in Live555's MP3 parser processes MPEG audio side information. The vulnerability is a classic buffer overflow: when parsing a crafted MP3 stream, the function writes beyond the allocated buffer for side information structures. This corrupts adjacent memory, leading to a crash (DoS). The root cause is missing validation of the side information length field in the MP3 frame header.

The vulnerable code path is triggered when Live555 receives an RTSP stream containing MP3 audio. The attacker does not need authentication; sending a malicious RTSP DESCRIBE or SETUP request with a crafted SDP body containing an MP3 payload can trigger the overflow.

Vulnerable vs. Patched Code

Vulnerable Code (Live555 v2018.09.02):

void MP3AudioStreamParser::getSideInfo2(unsigned char* to, unsigned from) {
  // No bounds check on 'from' offset
  memcpy(to, fInputBuffer + from, SIDE_INFO_SIZE);
}

Patched Code (Hypothetical):

void MP3AudioStreamParser::getSideInfo2(unsigned char* to, unsigned from) {
  if (from + SIDE_INFO_SIZE > fInputBufferSize) {
    // Handle error, reject stream
    return;
  }
  memcpy(to, fInputBuffer + from, SIDE_INFO_SIZE);
}

Exploitation & Lab Setup

Red Team

1. Setup: Run Live555 MediaServer v2018.09.02 on a Linux VM (e.g., Ubuntu 18.04).
2. Craft Payload: Create a malicious MP3 file with an oversized side information field.
3. Deliver: Use a Python script to send an RTSP DESCRIBE request with the malicious MP3 stream.
4. Trigger: The server crashes upon parsing the crafted stream.

Example Python script (conceptual):

import socket

def exploit(target_ip, target_port=554):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    
    # Craft RTSP DESCRIBE with malicious SDP
    payload = b"DESCRIBE rtsp://" + target_ip.encode() + b"/malicious.mp3 RTSP/1.0\r\n"
    payload += b"CSeq: 1\r\n"
    payload += b"Accept: application/sdp\r\n\r\n"
    
    sock.send(payload)
    response = sock.recv(4096)
    print(response)
    sock.close()

exploit("192.168.1.100")

Blue Team

1. Monitor: Watch for RTSP requests with unusually large SDP bodies or malformed MP3 headers.
2. Honeypot: Deploy a Live555 honeypot to capture exploit attempts.
3. Network Segmentation: Isolate media servers from untrusted networks.
4. WAF/IDS: Block RTSP requests with anomalous payload sizes.

Indicators of Compromise (IOCs)

• Network: RTSP requests with SDP bodies containing MP3 frames with side info length > 32 bytes.
• Logs: Live555 crash logs showing SIGSEGV in MP3AudioStreamParser::getSideInfo2.
• Memory: Heap corruption patterns in the media server process.
• File: Malicious MP3 files with crafted side information (e.g., ffmpeg -i normal.mp3 -f mp3 -bitexact crafted.mp3).

Detection Engineering

YARA Rule

rule CVE_2025_65404_Live555_MP3_Overflow {
    meta:
        description = "Detects crafted MP3 streams targeting CVE-2025-65404"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $side_info = { FF [2] (E0|E1|E2|E3) [1] (00|01|02|03) }  // MP3 frame header with side info
        $overflow = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }  // placeholder for overflow pattern
    condition:
        $side_info and #side_info > 10
}

Sigma Rule

title: CVE-2025-65404 Live555 MP3 Buffer Overflow
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects RTSP requests with malformed MP3 streams targeting Live555
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_proto: "rtsp"
        payload|contains: "application/sdp"
        payload|contains: "audio/MPA"
    condition: selection
falsepositives:
    - Legitimate MP3 streams with large side info
level: high

Suricata Rule

alert tcp any any -> any 554 (msg:"CVE-2025-65404 Live555 MP3 Buffer Overflow Attempt"; flow:to_server; content:"DESCRIBE"; content:"audio/MPA"; distance:0; within:100; content:"|FF|"; offset:0; depth:4; byte_test:2,>,32,2; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable MP3 support in Live555 if not required.
2. Short-term: Apply input validation on MP3 side information length in getSideInfo2().
3. Long-term: Upgrade to a patched version when available. Monitor Live555 GitHub for updates.
4. Workaround: Use a reverse proxy (e.g., Nginx with RTMP module) to filter malformed streams.
5. Detection: Deploy the provided YARA/Sigma/Suricata rules.

Valters IT